Ecto uses parameterized queries so is very safe unless one is careless using fragments.
In mixed environments this is still an issue, and I tend to be conservative and think in multiple layers of defense when it comes to these things. It is my pessimism from 30+ years of working in infosec and cyber security.
Where I typically focus use of stored procedures for specific use cases, which are typically complex updates and complex queries such as RCTE’s, or where it is an important thing to get right, where many tables may be involved but I want a logical action or where I want to insulate the application from complex schema or db schema churn.
For example I use this graph querying in Postgres approach which makes you wonder why things like Neo4j ever had a reason to exist. But I don’t want application layer solving the graph querying logic so it makes sense to be in the database.
Thanks for the book tip. I’ve been looking into application layering more because of it, and see how it is applicable to my original question and why it is important.
Those books help to get the thinking right and you will also see the CRC pattern used repeatedly (Construct, Reduce, Convert) and concepts of the functional core “pipe land” and the boundary layer (“with” land).
I think these books provide some good fundamentals to be aware of which reply help with structuring things.
It’s always good to learn different ways of thinking and structuring the problem, especially for myself having been water boarded in the imperative style and object oriented programming mindset for almost 30 years, functional programming was the necessary step to cleaner, more testable and maintainable systems. When I get a banana it’s just a bannana, not a banana with the gorilla holding it and the jungle too.
