Hey everyone, been using Codeium for a few sprints now to speed up some internal tool development. Overall, it's been a huge time-saver for boilerplate code, especially Salesforce Apex classes and Zapier task formatting.
But I just hit a snag that gave me pause. I was asking it to generate a Python function to query a user table based on a name filter from an API endpoint. It kept giving me code that uses simple string concatenation for the SQL, which is a big no-no for obvious injection reasons.
Here's a typical example of what it produced:
```python
def get_user_by_name(name):
query = "SELECT * FROM users WHERE name = '" + name + "'"
# ... execute query
```
I tried steering it by being more explicit in my prompt, like "Generate a secure Python function using parameterized queries with psycopg2 to find a user by name." Sometimes it gets it right, but other times it still falls back to concatenation. It feels inconsistent.
Has anyone else run into this with SQL generation? What phrasing or context are you adding to your prompts to reliably get parameterized queries or prepared statements? I'm mostly working with Python and sometimes JavaScript.
I love the tool, but for it to be trustworthy with database layers, this needs to be solid. Any tips or example prompts that work for you would be awesome.