[Q] REST API query parameters in Go

xuanbao · · 693 次点击    
这是一个分享于 的资源,其中的信息可能已经有所发展或是发生改变。
<p>Any advice on implementing complex query parameters in Go for a REST API that is backed by a SQL database like Postgres?<br/> For example: <strong>filtering</strong> -- <em>GET /cars?seats&lt;=2</em>, <strong>pagination</strong> -- <em>GET /cars?offset=10&amp;limit=5</em>, and <strong>sorting</strong> -- <em>GET /cars?sort=-manufactorer,+model</em></p> <hr/>**评论:**<br/><br/>skarlso: <pre><p>Down vote reason: </p> <p>If I understand what you want correctly, you are aiming to convert parameters in a HTML call directly to postgres type SQL commands.</p> <p>If that is correct -&gt; Do not do that. Just.... Don&#39;t. You don&#39;t want to surface database types of ANY kind to your VISIBLE rest layer. These should be as much detached as possible. The Database shouldn&#39;t even exits. And surfacing even the fact that you are using something relational, is reason enough to not to do that. And putting something like /cars?seats&lt;=2 ???? in a URL? Just... don&#39;t. </p> <p>Not to mention the legway you will have to go through in escaping all that and sanitising so it doesn&#39;t get to be a SQL injection. So, label me unfair, but I, personally, opinion basedwise, think that this is a terrible idea. :)</p></pre>FourSigma: <pre><p>I totally agree with you about the vulnerability but my application escapes these parameters before it reaches the datastore layer. </p></pre>skarlso: <pre><p>That is awesome, but isn&#39;t that sort of unnecessary? It&#39;s like, I&#39;m giving my enemy a gun to shoot me with, BUT I&#39;m wearing a high-tech bulletproof kevlar. </p></pre>FourSigma: <pre><p>aha...love the metaphor </p></pre>skarlso: <pre><p>Thanks. :-)</p></pre>DigitalDolt: <pre><p>The point of putting REST in front of SQL is to abstract away implementation details.</p> <p>If you want query items forwarded to your data store then you should just use something like CouchDB.</p></pre>FourSigma: <pre><p>Thanks! I decided wrap my API around PostgREST since this is for my own in house use data project. <a href="https://github.com/begriffs/postgrest" rel="nofollow">https://github.com/begriffs/postgrest</a></p></pre>DigitalDolt: <pre><p>Nice! I didn&#39;t know that existed. A while back I was looking at CouchDB because I wanted REST straight to the database, but PostgREST looks way better.</p></pre>

入群交流(和以上内容无关):加入Go大咖交流群,或添加微信:liuxiaoyan-s 备注:入群;或加QQ群:692541889

693 次点击  
加入收藏 微博
0 回复
暂无回复
添加一条新回复 (您需要 登录 后才能回复 没有账号 ?)
  • 请尽量让自己的回复能够对别人有帮助
  • 支持 Markdown 格式, **粗体**、~~删除线~~、`单行代码`
  • 支持 @ 本站用户;支持表情(输入 : 提示),见 Emoji cheat sheet
  • 图片支持拖拽、截图粘贴等方式上传