Any way to avoid the SQL bugs and execute raw strings?

[shirleyquirk]

you're inserting "my_string", which it's doing properly. I don't see any 
escaping of underscores either. if `my_string` is a variable, don't quote it 
when you pass it to, e.g. `db.exec(query,my_string)`

here `dbFormat` is lifted from `db_sqlite`
    
    
    import db_sqlite
    proc dbFormat(formatstr: SqlQuery, args: varargs[string]): string =
      result = ""
      var a = 0
      for c in items(string(formatstr)):
        if c == '?':
          add(result, dbQuote(args[a]))
          inc(a)
        else:
          add(result, c)
    
    let my_string = "hello"
    
    let qry = sql"INSERT INTO my_table (my_col) values (?)"
    
    var x = dbFormat(qry, "my_string")
    
    assert x.string == "INSERT INTO my_table (my_col) values ('my_string')"
    
    x = dbFormat(qry, my_string)
    
    assert x.string == "INSERT INTO my_table (my_col) values ('hello')"
    
    
    Run