In Python I use parameterised queries to prevent SQL injection. How does EK9 handle input sanitisation?

← Security and Sanitization · Ref: Q1015

EK9 enforces input sanitisation at COMPILE TIME with the 'sanitized' keyword. This is unique — no other language does this.

Python relies on runtime discipline:

  cursor.execute('SELECT * FROM users WHERE name = %s', (user_input,))  # Safe
  cursor.execute(f'SELECT * FROM users WHERE name = {user_input}')       # UNSAFE

EK9 makes unsafe code a COMPILE ERROR:

  processQuery()
    -> userInput as sanitized String
    <- rtn as String: `SELECT * FROM users WHERE name = ${userInput}`

The 'sanitized' keyword tells the compiler this parameter comes from external input. The compiler then tracks it through all operations and rejects any pattern that could allow injection.

You cannot pass a raw unsanitized String where a sanitized String is expected — the compiler rejects it. This prevents the entire class of injection vulnerabilities at compile time rather than relying on developer discipline.

Sanitized parameters work on functions, methods, and service endpoints.

Example

defines module qa.security.frompythonsqlsafety

  defines function

    buildSafeGreeting() as pure
      -> userName as String
      <- rtn as String: `Hello, ${userName}`

  defines program

    SqlSafetyDemo()
      stdout <- Stdout()

      // Safe: using known values
      trustedName <- "Alice"
      greeting <- buildSafeGreeting(trustedName)
      stdout.println(greeting)

      // In a real service, parameters from HTTP requests would be 'sanitized':
      // processRequest()
      //   -> queryParam as sanitized String
      //   <- rtn as HTTPResponse: ...
      // The compiler tracks sanitized values and rejects unsafe operations

      stdout.println("EK9 enforces input safety at compile time")
Other ways to ask this
  • How do I prevent injection attacks in EK9?
  • What is the EK9 equivalent of SQL parameterised queries?
  • How does EK9's sanitized keyword work for safe input handling?

Coming from another language?

Python developers: your parameterised queries discipline becomes compile-time enforcement in EK9. The 'sanitized' keyword makes injection impossible, not just unlikely.

Keywords: security, compile time, injection, sanitized, python, sql, migration