Applications with Rullst I · Lesson 08 / 14

Create: text stays data

An apostrophe in a title must not break the query.

Let's discover together

1
In POST, the handler receives JSON, validates and calls Store::create. SQL uses VALUES (?, ?); bind sends title and priority as values. Do not concatenate input into SQL: O'Brien is a common name, and other text may resemble commands.
2
After INSERT, last_insert_rowid identifies the new record. The 201 response returns that id and normalized values, including done=false. A repeated title creates another record; this project defines neither title uniqueness nor submission deduplication.
3
Inspect the test with an apostrophe, HTML markup and SQL-like text. After the call, the table still exists and the title remains text. This checks that parameterized path; it does not prove an entire app immune to injection or solve authorization.
4
A single SQLite INSERT is atomic: the row is inserted or the statement fails. If a future action changes several tables as one unit, a transaction must cover every step. Do not call two independent writes one transaction.

Your application workbench

The kit includes a complete app to investigate and modify. The excerpt below explains this step; the editor contains the indicated file. Rullst Academy does not compile or run this server in your browser.

File to study and modify

src/store.rs

sqlx::query("INSERT INTO missions (title, priority) VALUES (?, ?)")
    .bind(&input.title)
    .bind(input.priority)
    .execute(&self.pool).await?

Extract the kit to a new folder and open a terminal beside Cargo.toml. Use Rust 1.96+; the first build may download dependencies and take time. Then open http://127.0.0.1:3010. Stop with Ctrl+C and run again after editing.

cargo test --locked
cargo run --locked

My files and GitHub

Download your draft and replace the indicated file in your extracted copy. The editor saves one file in this browser; your account saves assessments and XP. The ZIP excludes your edits. GitHub sends only the confirmed file; use Git manually for the whole app, excluding databases, backups and secrets.

Official links and next step

SQLite: parameters and expressions

✦

YOUR MISSION

Trace a validated creation through a parameterized INSERT to a 201 response.

Take it with you

Create a title with an apostrophe and check response, listing and restart. Add a test with another unusual valid input. Explain how bind separates instruction and value without claiming to solve permissions.

At your own pace

My files and GitHub

Every lesson can become your own record: code, notes or a practice plan. Saving a file to GitHub is optional and does not change your XP.

Student guide

The editor and downloads open when this lesson is available to your account. Check access below or return to the track map.

Checking your access to this lesson…

Your path, step by step

Download activity materials

Download the lesson example and a workbook for your notes. The ZIP includes a guide to organizing activities in one or more repositories. Publishing is optional; eligible accounts can also use the GitHub upload button.

Your file for this lesson

Edit the example or record what you learned. This space does not run code or grade answers. The draft is saved only in this browser, separately per account; you choose when to download or upload to GitHub.

The example may be only a snippet or outline. Changing the extension does not make it a complete program. The activity ZIP contains starting material; the edited-file button downloads your text.

My code or notes

use crate::validation::NewMission;
use rullst::orm::sqlx::{
    self, Row, SqlitePool,
    sqlite::{SqliteConnectOptions, SqlitePoolOptions},
};
use serde::Serialize;
use std::{path::Path, time::Duration};

#[derive(Clone)]
pub struct Store {
    pub pool: SqlitePool,
}

#[derive(Debug, Serialize)]
pub struct Mission {
    pub id: i64,
    pub title: String,
    pub priority: i64,
    pub done: bool,
}

impl Store {
    pub async fn open(path: &Path) -> Result<Self, sqlx::Error> {
        let options = SqliteConnectOptions::new()
            .filename(path)
            .create_if_missing(true)
            .foreign_keys(true)
            .busy_timeout(Duration::from_secs(5));
        let pool = SqlitePoolOptions::new()
            .max_connections(1)
            .connect_with(options)
            .await?;
        let version: i64 = sqlx::query_scalar("PRAGMA user_version")
            .fetch_one(&pool)
            .await?;
        if version > 1 {
            return Err(sqlx::Error::Protocol("Unsupported schema version".into()));
        }
        sqlx::raw_sql(include_str!("../schema.sql"))
            .execute(&pool)
            .await?;
        Ok(Self { pool })
    }

pub async fn list(&self) -> Result<Vec<Mission>, sqlx::Error> {
        let rows = sqlx::query("SELECT id, title, priority, done FROM missions ORDER BY priority DESC, id ASC LIMIT 100")
            .fetch_all(&self.pool).await?;
        rows.into_iter()
            .map(|row| {
                Ok(Mission {
                    id: row.try_get("id")?,
                    title: row.try_get("title")?,
                    priority: row.try_get("priority")?,
                    done: row.try_get("done")?,
                })
            })
            .collect()
    }

// Only validated input reaches this operation through the HTTP handler.
    pub async fn create(&self, input: NewMission) -> Result<Mission, sqlx::Error> {
        let result = sqlx::query("INSERT INTO missions (title, priority) VALUES (?, ?)")
            .bind(&input.title)
            .bind(input.priority)
            .execute(&self.pool)
            .await?;
        Ok(Mission {
            id: result.last_insert_rowid(),
            title: input.title,
            priority: input.priority,
            done: false,
        })
    }

pub async fn complete(&self, id: i64, done: bool) -> Result<bool, sqlx::Error> {
        let result = sqlx::query("UPDATE missions SET done = ? WHERE id = ?")
            .bind(done)
            .bind(id)
            .execute(&self.pool)
            .await?;
        Ok(result.rows_affected() == 1)
    }
}

File format

Your text will be saved in this browser when you edit it. On a shared computer, clear your drafts when finished.

Direct upload accepts up to 8 KiB of text in one file. Use downloads and the manual guide for projects with multiple files.

Create: text stays data

Let's discover together

Your application workbench

File to study and modify

Official links and next step

Now it's your turn

Decide before running

Take it with you

My files and GitHub

Your file for this lesson

Save to my GitHub

Rullstpetbot