In Python I build SQL queries with f-strings. How do I build strings safely in EK9?

← Getting Started · Ref: Q1013

EK9 uses backtick strings with ${expression} for interpolation, similar to Python f-strings.

Python: f"Hello {name}, you have {count} items"
EK9: `Hello ${name}, you have ${$count} items`

KEY DIFFERENCES:

- EK9 uses backticks ` not quotes with f prefix
- EK9 uses ${expression} not {expression}
- For non-String types, use $variable inside ${} to convert: ${$count} converts Integer to String
- Double-quoted strings "..." are plain text — no interpolation

SAFE STRING BUILDING:

Python: f"SELECT * FROM users WHERE id = {user_id}" (UNSAFE — SQL injection)
EK9 equivalent would also be unsafe if done this way.

For safe parameterised strings, build them with named variables:

  tableName <- "users"
  columnName <- "id"
  query <- `SELECT * FROM ${tableName} WHERE ${columnName} = ?`

EK9's sanitized parameters can prevent injection at compile time for web services.

Example

defines module qa.gettingstarted.frompythonstringbuilding

  defines program

    StringBuildingDemo()
      stdout <- Stdout()

      // Like Python: f"Hello {name}"
      userName <- "Alice"
      greeting <- `Hello ${userName}`
      stdout.println(greeting)

      // Like Python: f"Score: {score}" (non-string needs conversion)
      score <- 95
      scoreLine <- `Score: ${score}`
      stdout.println(scoreLine)

      // Like Python: f"{first} {last} ({age})"
      firstName <- "Bob"
      lastName <- "Smith"
      age <- 30
      fullDescription <- `${firstName} ${lastName} (${age})`
      stdout.println(fullDescription)

      // Double-quoted strings are plain — no interpolation
      plainText <- "This ${is} not interpolated"
      stdout.println(plainText)

Coming from another language?

Python developers: f-strings map to EK9 backtick strings. Use ${expression} instead of {expression}. Double-quoted strings have no interpolation.

Keywords: backtick, safe, string, python, migration, interpolation, fstring