Does string interpolation in raw queries affect prepared statements and query caching?

[Datron]

Hi,
Lets say I have a query like this:

let sql = format!(
        "
    INSERT INTO {db_namespace}.dimensions
    (dimension, priority, created_at, created_by, schema)
    VALUES ($1, $2, $3, $4, $5)
    ON CONFLICT (dimension)
    DO UPDATE SET priority = $6,
     created_at = $7,
     created_by = $8,
     schema = $9
            "
    );

 let upsert = diesel::sql_query(sql)
        .bind::<diesel::sql_types::VarChar, _>(&new_dimension.dimension)
        .bind::<diesel::sql_types::Integer, _>(&new_dimension.priority)
        .bind::<diesel::sql_types::Timestamptz, _>(&new_dimension.created_at)
        .bind::<diesel::sql_types::VarChar, _>(&new_dimension.created_by)
        .bind::<diesel::sql_types::Json, _>(&new_dimension.schema)
        .bind::<diesel::sql_types::Integer, _>(&new_dimension.priority)
        .bind::<diesel::sql_types::Timestamptz, _>(&new_dimension.created_at)
        .bind::<diesel::sql_types::VarChar, _>(&new_dimension.created_by)
        .bind::<diesel::sql_types::Json, _>(&new_dimension.schema)
        .execute(&mut conn);

I'm trying to figure out what could go wrong with doing something like this.

[weiznich]

Prepared statements for queries issued via sql_query are not cached as described here: https://docs.diesel.rs/2.2.x/diesel/connection/statement_cache/index.html#a-primer-on-prepared-statement-caching-in-diesel

That written: By using format! to construct your SQL queries you open the possibility for sql injections.

[Datron]

Thanks @weiznich!