7 ms·

Type coercion does not necessarily imply the contents were execute as code.

by martinko 10y ago

eyelidlessness 10y ago
I'm not aware of any language that coerces the string `'null'` to the value `null`. Are you aware of any?
- DougBTX 10y ago
  A badly coded website could go in the other direction, eg in JS, someone writes a poor string equality check: function normalise(s) { return (s + "").toLowerCase(); } function isEqual(a, b) { return normalise(a) == normalise(b); } And then someone else uses it in some form validation logic: if (isEqual(surname, null)) { return error; }
  - jerf 10y ago
    Then as the next step, some programmer somewhere notices that all the NULLs in the database have been converted into strings somewhere, and puts UPDATE table SET column = NULL WHERE column = "NULL" somewhere, maybe even in a trigger, and that's that. The problem with data destruction is that only one thing in the entire data pipeline has to spuriously map two distinct values to the same output value, and the data is destroyed and can not be recovered. Very few programmers think carefully about whether a serialization or data transfer format maps every single possible input to a different output. It may only take one oversight to ruin your year.
- DaiPlusPlus 10y ago
  Java and JavaScript do the opposite: null values are represented by the string "null" ( http://stackoverflow.com/questions/24591212/why-the-coercion-of-null-string-to-null-string http://stackoverflow.com/questions/24591212/why-the-coercion... ) - it's conceivable many programs processing strings would assume "null" in a string comes from a null value originally.
  - nilved 10y ago
    Your inaccurate description gave me a small heart attack. We all know JavaScript is horrible, but that is next-level horrible. null is coerced to "null" when it's needed as a string. This behaviour is similar to printf in C. It's not the case that "null" === null like True == 1 in Python. (This would be my interpretation of "x is represented by y".)
    - throwanem 10y ago
      If you want 'next-level horrible', open your browser's console and take a look at what you get back from "typeof null".
      - valleyer 10y ago
        JavaScriptCore: >>> typeof null object >>> typeof "null" string >>> typeof (null + "") string
        menssen 10y ago
        Something always bugs me about this criticism: #1 arguably makes sense. Unless "null" were a "type" (which it isn't), the other possible options for this ("undefined", or "string", "number", "array", etc.) all make less sense. #2 is expected/correct. #3 makes sense if you accept that the "+" operator aggressively casts its arguments to strings when they are anything other than two numbers. Arguably that's a bad design, but it's not unexpected or unpredictable. The one completely unexplainable "+" behavior I know of in JS (i.e., a recent node/v8) is the second of these: > [] + {} '[object Object]' // makes sense because the string representation of [] is '' > {} + [] 0 // ??? > var x = {} + [] undefined > x '[object Object]' // but assigning to a variable first makes sense again
        masklinn 10y ago
        > #1 arguably makes sense. Unless "null" were a "type" (which it isn't), the other possible options for this ("undefined", or "string", "number", "array", etc.) all make less sense. `typeof` gets the primitive type of a value, and exactly like undefined null is a primitive value with its own primitive type, as `typeof undefined` returns `"undefined"` `typeof null` was supposed to return `"null"`, it doesn't due to a bug in the original implementation which was then spec-enshrined as fixing it would break too much stuff: http://www.2ality.com/2013/10/typeof-null.html http://www.2ality.com/2013/10/typeof-null.html
- saurik 10y ago
  It tends to not be in programming languages but in textual data formats (including many standard implementations of comma-separated files) and even databases that can only hold string values by nature but also want a way to represent null (and fail to fix this by escaping the hell out of everything with quotation marks, and yet it isn't that "code" is executing).
- adzicg 10y ago
  ColdFusion does. There was a famous stackoverflow thread on that "We have an employee whose last name is Null. Our employee lookup application is killed when that last name is used as the search term (which happens to be quite often now)" http://stackoverflow.com/questions/4456438/how-to-pass-null-a-real-surname-to-a-soap-web-service-in-actionscript-3 http://stackoverflow.com/questions/4456438/how-to-pass-null-...
- esrauch 10y ago
  Rails at least used to do this when reading back from a database (eg if you had a nullable string field it would come back as nil if it happened to be the literal "nil") Edit: IIRC there was a directive that would prevent the behavior though?

Type coercion does not necessarily imply the contents were execute as code.

eyelidlessness 10y ago

I'm not aware of any language that coerces the string `'null'` to the value `null`. Are you aware of any?

DougBTX 10y ago
A badly coded website could go in the other direction, eg in JS, someone writes a poor string equality check: function normalise(s) { return (s + "").toLowerCase(); } function isEqual(a, b) { return normalise(a) == normalise(b); } And then someone else uses it in some form validation logic: if (isEqual(surname, null)) { return error; }
- jerf 10y ago
  Then as the next step, some programmer somewhere notices that all the NULLs in the database have been converted into strings somewhere, and puts UPDATE table SET column = NULL WHERE column = "NULL" somewhere, maybe even in a trigger, and that's that. The problem with data destruction is that only one thing in the entire data pipeline has to spuriously map two distinct values to the same output value, and the data is destroyed and can not be recovered. Very few programmers think carefully about whether a serialization or data transfer format maps every single possible input to a different output. It may only take one oversight to ruin your year.
DaiPlusPlus 10y ago
Java and JavaScript do the opposite: null values are represented by the string "null" ( http://stackoverflow.com/questions/24591212/why-the-coercion-of-null-string-to-null-string http://stackoverflow.com/questions/24591212/why-the-coercion... ) - it's conceivable many programs processing strings would assume "null" in a string comes from a null value originally.
- nilved 10y ago
  Your inaccurate description gave me a small heart attack. We all know JavaScript is horrible, but that is next-level horrible. null is coerced to "null" when it's needed as a string. This behaviour is similar to printf in C. It's not the case that "null" === null like True == 1 in Python. (This would be my interpretation of "x is represented by y".)
  - throwanem 10y ago
    If you want 'next-level horrible', open your browser's console and take a look at what you get back from "typeof null".
    - valleyer 10y ago
      JavaScriptCore: >>> typeof null object >>> typeof "null" string >>> typeof (null + "") string
      - menssen 10y ago
        Something always bugs me about this criticism: #1 arguably makes sense. Unless "null" were a "type" (which it isn't), the other possible options for this ("undefined", or "string", "number", "array", etc.) all make less sense. #2 is expected/correct. #3 makes sense if you accept that the "+" operator aggressively casts its arguments to strings when they are anything other than two numbers. Arguably that's a bad design, but it's not unexpected or unpredictable. The one completely unexplainable "+" behavior I know of in JS (i.e., a recent node/v8) is the second of these: > [] + {} '[object Object]' // makes sense because the string representation of [] is '' > {} + [] 0 // ??? > var x = {} + [] undefined > x '[object Object]' // but assigning to a variable first makes sense again
        masklinn 10y ago
        > #1 arguably makes sense. Unless "null" were a "type" (which it isn't), the other possible options for this ("undefined", or "string", "number", "array", etc.) all make less sense. `typeof` gets the primitive type of a value, and exactly like undefined null is a primitive value with its own primitive type, as `typeof undefined` returns `"undefined"` `typeof null` was supposed to return `"null"`, it doesn't due to a bug in the original implementation which was then spec-enshrined as fixing it would break too much stuff: http://www.2ality.com/2013/10/typeof-null.html http://www.2ality.com/2013/10/typeof-null.html
saurik 10y ago
It tends to not be in programming languages but in textual data formats (including many standard implementations of comma-separated files) and even databases that can only hold string values by nature but also want a way to represent null (and fail to fix this by escaping the hell out of everything with quotation marks, and yet it isn't that "code" is executing).
adzicg 10y ago
ColdFusion does. There was a famous stackoverflow thread on that "We have an employee whose last name is Null. Our employee lookup application is killed when that last name is used as the search term (which happens to be quite often now)" http://stackoverflow.com/questions/4456438/how-to-pass-null-a-real-surname-to-a-soap-web-service-in-actionscript-3 http://stackoverflow.com/questions/4456438/how-to-pass-null-...
esrauch 10y ago
Rails at least used to do this when reading back from a database (eg if you had a nullable string field it would come back as nil if it happened to be the literal "nil") Edit: IIRC there was a directive that would prevent the behavior though?