3 ms·
hey feel free to checkout the golang code here https://github.com/activityclub/pointspaced https://github.com/activityclub/pointspaced it's way more versatile t
by andrewfromx 9y ago
hey feel free to checkout the golang code here https://github.com/activityclub/pointspaced https://github.com/activityclub/pointspaced it's way more versatile than sql for our needs. BTW the #{id} we call .to_i on it first so ruby will make that 0 if it's a string with a single quote or something.
- packetized 9y agoThat sounds like a recipe for disaster, if that's the only thing you're relying on for input validation of #{id}.
- andrewfromx 9y agowhat do you mean. "wefwkefjwe'".to_i will goto zero every time. How is sql injection possible if I to_i your string?
- slantyyz 9y agoWouldn't it be better to not even run the query if id is a non-integer value, or does id = 0 have some intrinsic meaning in your data?
- matt4077 9y agoI've had only a cursory look, but it really feels as if you're reinventing database indices. Indices are based on the same logic, i. e. "99% are reads, let's try to do more work on writes". Redis is great. But to be honest: so is MySQL. If you give MySQL enough RAM and create the right indices, you can easily get to 6-digit numbers of queries per second.
- andrewfromx 9y agohttps://news.ycombinator.com/item?id=14500889 https://news.ycombinator.com/item?id=14500889