3 ms·

#DeveloperFail Funny, the page asks for your name, and if you have ' like Irish names, it marks the name in Red (invalid) and doesn't let you move forward with

#DeveloperFail Funny, the page asks for your name, and if you have ' like Irish names, it marks the name in Red (invalid) and doesn't let you move forward with finding out the books. I tested it with the following names. James O'Keefe Mullah O'Mar

herbst 10y ago
Same for äöü. Dev hates foreigners obviously
Tharre 10y ago
Why can't a name simply be a string of length X? All this work of checking for "correct" names is so pointless.
- throwanem 10y ago
  Badly written SQL generation often prompts single quotes being forbidden in input. "Having single quotes there breaks my queries," one sometimes hears said. "I don't know why." This is a great opportunity to mentor one's juniors. An injection attack is trivial to demonstrate in the local dev environment, and the result strongly motivates anyone worth working with to learn how not to do that again.
  - projektfu 10y ago
    For the 10,000 who might be learning about this today, the answer is prepared statements with placeholders for the values, like this pseudocode: stmt = driver.prepare("insert into names (firstname, lastname) values (?, ?)"); stmt.execute("Flannery", "O'Connor"); Syntax varies among database interfaces but this ensures that any odd strings are properly stored by the driver and the application does not need to worry about them. There is also no risk of someone rewriting the SQL statement.
btschaegg 10y ago
Sounds like a very hacky way to avoid little Bobby Tables...
- Oletros 10y ago
  But it also forbids characters like ñ or í
CapacitorSet 10y ago
Getting names right is very hard: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
- jnbiche 10y ago
  No, getting names right is incredibly simple. It's a single unicode `name` field, stored however your language/db stores unicode. E.g.: name: [person's name] No minimum lengths (other than != 0) and a reasonably large maximum length for your db (only to protect against DoS attacks). Accept all input (into properly prepared SQL statements).
  - CapacitorSet 10y ago
    Reread the list with your assumptions in mind (one nonzero-length field, with a maximum field, Unicode).
sean_patel 10y ago
Why the downvotes? Sorry for calling it out, but it is indeed a #DeveloperFail. We (developers) have egos bigger than doctors and lawyerys, is that why everyone is downvoting a legitimate assertion with proof? (and more proof in comments to my original comment )

herbst 10y ago

Same for äöü. Dev hates foreigners obviously

Tharre 10y ago

Why can't a name simply be a string of length X? All this work of checking for "correct" names is so pointless.

throwanem 10y ago
Badly written SQL generation often prompts single quotes being forbidden in input. "Having single quotes there breaks my queries," one sometimes hears said. "I don't know why." This is a great opportunity to mentor one's juniors. An injection attack is trivial to demonstrate in the local dev environment, and the result strongly motivates anyone worth working with to learn how not to do that again.
- projektfu 10y ago
  For the 10,000 who might be learning about this today, the answer is prepared statements with placeholders for the values, like this pseudocode: stmt = driver.prepare("insert into names (firstname, lastname) values (?, ?)"); stmt.execute("Flannery", "O'Connor"); Syntax varies among database interfaces but this ensures that any odd strings are properly stored by the driver and the application does not need to worry about them. There is also no risk of someone rewriting the SQL statement.

btschaegg 10y ago

Sounds like a very hacky way to avoid little Bobby Tables...

Oletros 10y ago
But it also forbids characters like ñ or í

CapacitorSet 10y ago

Getting names right is very hard: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

jnbiche 10y ago
No, getting names right is incredibly simple. It's a single unicode `name` field, stored however your language/db stores unicode. E.g.: name: [person's name] No minimum lengths (other than != 0) and a reasonably large maximum length for your db (only to protect against DoS attacks). Accept all input (into properly prepared SQL statements).
- CapacitorSet 10y ago
  Reread the list with your assumptions in mind (one nonzero-length field, with a maximum field, Unicode).

sean_patel 10y ago

Why the downvotes? Sorry for calling it out, but it is indeed a #DeveloperFail. We (developers) have egos bigger than doctors and lawyerys, is that why everyone is downvoting a legitimate assertion with proof? (and more proof in comments to my original comment )