A query string. This type is intended to make it difficult to
construct a SQL query by concatenating string fragments, as that is an
extremely common way to accidentally introduce SQL injection
vulnerabilities into an application.
This type is an instance of
IsString, so the easiest way to
construct a query is to enable the
OverloadedStrings language
extension and then simply write the query in double quotes.
{-# LANGUAGE OverloadedStrings #-}
import Database.PostgreSQL.Simple
q :: Query
q = "select ?"
The underlying type is a
ByteString, and literal Haskell
strings that contain Unicode characters will be correctly transformed
to UTF-8.