String concatenation for SQL queries is a common source of problems. The author advocates for using a SQL builder API instead of raw SQL strings. This builder constructs a syntax tree that can be rendered into SQL when needed, avoiding the issues of direct string manipulation. While ORMs are also an option, the author views them as leaky abstractions. The team was using Java and followed a rule to use a builder, not SQL strings. However, they used a StringBuilder for construction, which technically fits the definition of a builder. This StringBuilder approach was merely string concatenation with extra steps. The example code demonstrates a StringBuilder used to create a query, but the resulting SQL string was fundamentally incorrect and incomplete for its intended purpose. The fact that this broken code ran in production without immediate detection is a significant concern. It implies that errors were silently ignored, or the flawed output was not critical enough to raise alarms. The author highlights this as a "WTF" moment, emphasizing the lack of robust error handling or validation.
StringBuilderfor construction, which technically fits the definition of a builder. ThisStringBuilderapproach was merely string concatenation with extra steps. The example code demonstrates aStringBuilderused to create a query, but the resulting SQL string was fundamentally incorrect and incomplete for its intended purpose. The fact that this broken code ran in production without immediate detection is a significant concern. It implies that errors were silently ignored, or the flawed output was not critical enough to raise alarms. The author highlights this as a "WTF" moment, emphasizing the lack of robust error handling or validation.