no more sql injection on searches! (hopefully) i also have a more scalable system for sql functions/procedures/etc

doc/resources.md

···
 ## database design
 
 - https://stackoverflow.com/questions/59505855/liked-posts-design-specifics
+	- my programmer brain automatically assumed "oh i can just store a list
+	in the user table!" turns out, that is a bad implementation.
+	- i do have scalability concerns with the current implementation, but i
+	can address those in the near future.
 
 ## sql
 
+postgresql documentation: https://www.postgresql.org/docs/
+
 - https://stackoverflow.com/questions/11144394/order-sql-by-strongest-like
+	- helped me develop the initial search system, which is subject to be
+	overhauled, but for now, this helped a lot.
+
+## sql security
+
+![xkcd comic #327](https://imgs.xkcd.com/comics/exploits_of_a_mom.png)
+
+source: xkcd, <https://xkcd.com/327/>
+
+- sql injections
+	- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#other-examples-of-safe-prepared-statements
+	- https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html#using-net-built-in-feature
+	- https://www.slideshare.net/slideshow/sql-injection-myths-and-fallacies/3729931#3

doc/todo.md

···
 	- could be used so that a github webhook can send a message when a new commit is pushed to beep!
 - [ ] site:log new accounts, account deletions, etc etc in an admin-accessible site log
 	- this should be set up to only log things when an admin enables it in the site config, so as to only log when necessary
+- [ ] site:implement a database keep-alive system
 
 ## ideas
 

src/beep_sql/beep_sql.v

···
+module beep_sql
+
+import os
+import db.pg
+
+fn load_procedures(mut db pg.DB) {
+	os.walk('src/beep_sql/procedures/', fn [mut db] (it string) {
+		println('-> loading procedure: ${it}')
+		db.exec(os.read_file(it) or { panic(err) }) or { panic(err) }
+	})
+}
+
+pub fn load(mut db pg.DB) {
+	println('-> loading sql code')
+	load_procedures(mut db)
+	println('<- done')
+}

src/beep_sql/procedures/search_posts.sql

···
+CREATE OR REPLACE FUNCTION search_for_posts (IN Query TEXT, IN Count INT, IN Index INT)
+RETURNS SETOF "Post"
+AS $$
+	SELECT *
+	FROM "Post"
+	WHERE title LIKE CONCAT('%', Query, '%') OR body LIKE CONCAT('%', Query, '%')
+	ORDER BY (CASE
+		WHEN title LIKE CONCAT('%', Query, '%') THEN 1
+		WHEN body LIKE CONCAT('%', Query, '%') THEN 2
+		END)
+	LIMIT Count OFFSET Index;
+$$ LANGUAGE SQL;

src/beep_sql/procedures/search_users.sql

···
+CREATE OR REPLACE FUNCTION search_for_users (IN Query TEXT, IN Count INT, IN Index INT)
+RETURNS SETOF "User"
+AS $$
+	SELECT *
+	FROM "User"
+	WHERE username LIKE CONCAT('%', Query, '%') OR nickname LIKE CONCAT('%', Query, '%')
+	ORDER BY (CASE
+		WHEN username LIKE CONCAT('%', Query, '%') THEN 1
+		WHEN nickname LIKE CONCAT('%', Query, '%') THEN 2
+		END)
+	LIMIT Count OFFSET Index;
+$$ LANGUAGE SQL;

src/database/post.v

···
 }
 
 // search_for_posts searches for posts matching the given query.
-// todo: query options/filters, such as user:beep, !excluded-text, etc
+// todo: levenshtein distance, query options/filters (user:beep, !excluded-text,
+// etc)
 pub fn (app &DatabaseAccess) search_for_posts(query string, limit int, offset int) []PostSearchResult {
-	//TODO: SANATIZE
-	sql_query := "\
-	SELECT *, CASE
-		WHEN title LIKE '%${query}%' THEN 1
-		WHEN body LIKE '%${query}%' THEN 2
-		END AS priority
-	FROM \"Post\"
-	WHERE title LIKE '%${query}%' OR body LIKE '%${query}%'
-	ORDER BY priority ASC LIMIT ${limit} OFFSET ${offset}"
-
-	queried_posts := app.db.q_strings(sql_query) or {
-		eprintln('search_for_posts error in app.db.q_strings: ${err}')
+	queried_posts := app.db.exec_param_many('SELECT * FROM search_for_posts($1, $2, $3)', [query, limit.str(), offset.str()]) or {
+		eprintln('search_for_posts error in app.db.error: ${err}')
 		[]
 	}
-
 	posts := queried_posts.map(|it| Post.from_row(it))
 	return PostSearchResult.from_post_list(app, posts)
 }

src/database/user.v

···
 // search_for_users searches for posts matching the given query.
 // todo: query options/filters, such as created-after:<date>, created-before:<date>, etc
 pub fn (app &DatabaseAccess) search_for_users(query string, limit int, offset int) []User {
-	//TODO: SANATIZE
-	sql_query := "\
-	SELECT *, CASE
-		WHEN username LIKE '%${query}%' THEN 1
-		WHEN nickname LIKE '%${query}%' THEN 2
-		END AS priority
-	FROM \"User\"
-	WHERE username LIKE '%${query}%' OR nickname LIKE '%${query}%'
-	ORDER BY priority ASC LIMIT ${limit} OFFSET ${offset}"
-
-	queried_users := app.db.q_strings(sql_query) or {
-		eprintln('search_for_users error in app.db.q_strings: ${err}')
+	queried_users := app.db.exec_param_many('SELECT * FROM search_for_users($1, $2, $3)', [query, limit.str(), offset.str()]) or {
+		eprintln('search_for_users error in app.db.error: ${err}')
 		[]
 	}
-
 	users := queried_users.map(|it| User.from_row(it))
 	return users
 }

src/main.v

···
 import entity
 import os
 import webapp { App, Context, StringValidator }
+import beep_sql
 
 fn main() {
 	config := webapp.load_config_from(os.args[1])
···
 	defer {
 		db.close()
 	}
+
+	beep_sql.load(mut db)
 
 	mut app := &App{
 		config: config