5 ms·
One thing that I've noticed in the Golang community, is that there is some disturbingly large number of programmers there who think it's a very good idea not to
by stcredzero 10y ago
One thing that I've noticed in the Golang community, is that there is some disturbingly large number of programmers there who think it's a very good idea not to use prepared statements and instead to use Input Escaping.
https://www.reddit.com/r/golang/comments/62513u/golang_persistence_i_want_the_security_of/dfkeljt/ https://www.reddit.com/r/golang/comments/62513u/golang_persi...
The justification? Better performance. Didn't the PHP community go through the exact same thing years ago? (With people finally giving up and going back to prepared statements for safety against SQL injection.)
It's so widespread that there are multiple libraries that tout this as a feature!
- tptacek 10y agoI have not noticed this reviewing code for clients, and would be equally disturbed --- anyone suggesting that prepared statements should be avoided in favor of escaping is perpetuating a dangerous falsehood.
- TazeTSchnitzel 10y agoPHP's PDO database abstraction layer actually escapes by default under the hood, but it presents a prepared statement interface.
- tyingq 10y agoYou can turn that off. It was there historically because mysql didn't always support it, and it was slow when it was first rolled out. Other languages old enough to have been around prior to all this have the same history. Perl, Python, etc.
- floatboth 10y agoOMG. How would escaping be faster than prepared statements if prepared statements are literally cached in the database server instead of re-parsing and re-planning every time?! o_0
- mohaine 10y agoTo be fair, it can be faster if the binds cause the plan to be much more efficient. I've had to remove binds before for this very reason. Note that this was exactly once in 20 years.
- deleted 10y ago[deleted]
- tyingq 10y agoIt happens. https://bugs.mysql.com/bug.php?id=73056 https://bugs.mysql.com/bug.php?id=73056
- literallycancer 10y agoAFAIK prepared statements don't let you change which table to use them for dynamically? Or am I misunderstanding something?
- zer0tonin 10y agoThey don't, but they still offer better speed and security than non prepared statement. And having to dynamically change a table name is uncommon.
- nawre 10y agoThe link you posted to support your claim demonstrates exactly the contrary: the person supporting that argument has been downvoted to oblivion until they saw fit to delete their account.
- stcredzero 10y agoAs far as I can see, the last part of your assertion is false. For their username, you need to include a trailing slash.
- Zikes 10y ago> It's so widespread that there are multiple libraries that tout this as a feature! Which libraries?