In Python I build SQL queries with f-strings. How do I build strings safely in EK9?

← Getting Started · Ref: Q1013

EK9 uses backtick strings with ${expression} for interpolation, similar to Python f-strings.

Python: f"Hello {name}, you have {count} items"
EK9: `Hello ${name}, you have ${count} items`

KEY DIFFERENCES:

- EK9 uses backticks ` not quotes with f prefix
- EK9 uses ${expression} not {expression}
- ${expression} calls the expression's $ operator, so any type that has one (Integer, Float, Boolean ...) interpolates directly: ${count} needs no extra conversion
- Double-quoted strings "..." are plain text — no interpolation, so a ${ inside one is a compile error (E07901)
- To print ${name} itself, escape the dollar in a backtick string: `\${name}`

SAFE STRING BUILDING:

Python: f"SELECT * FROM users WHERE id = {user_id}" (UNSAFE — SQL injection)
EK9 equivalent would also be unsafe if done this way.

For safe parameterised strings, build them with named variables:

  tableName <- "users"
  columnName <- "id"
  query <- `SELECT * FROM ${tableName} WHERE ${columnName} = ?`

EK9's sanitized parameters can prevent injection at compile time for web services.

Example

defines module qa.gettingstarted.frompythonstringbuilding

  defines program

    StringBuildingDemo()
      stdout <- Stdout()

      // Like Python: f"Hello {name}"
      userName <- "Alice"
      greeting <- `Hello ${userName}`
      stdout.println(greeting)

      // Like Python: f"Score: {score}" (an Integer interpolates directly)
      score <- 95
      scoreLine <- `Score: ${score}`
      stdout.println(scoreLine)

      // Like Python: f"{first} {last} ({age})"
      firstName <- "Bob"
      lastName <- "Smith"
      age <- 30
      fullDescription <- `${firstName} ${lastName} (${age})`
      stdout.println(fullDescription)

      // Double-quoted strings are plain text - a ${ inside one is a compile error (E07901)
      plainText <- "Plain text, never interpolated"
      stdout.println(plainText)

      // To print ${...} itself, escape the dollar in a backtick string
      literalText <- `Python's f"{name}" is EK9's \${name}`
      stdout.println(literalText)

Common mistakes

E07901 — Only a backtick String interpolates. A double-quoted String holding ${ is a compile error (E07901) - it would otherwise print the characters, not the values. See ek9 -h E07901 for details.

Incorrect:

fullDescription <- "${firstName} ${lastName} (${age})"

Correct:

fullDescription <- `${firstName} ${lastName} (${age})`

Coming from another language?

Python developers: f-strings map to EK9 backtick strings. Use ${expression} instead of {expression}. Double-quoted strings have no interpolation - "${name}" is a compile error (E07901), where Kotlin, Groovy, Dart, PHP and the shells would interpolate it.

Keywords: python, string, safe, backtick, fstring, interpolation, migration