4 ms·
> Sometimes things get simplified in tutorials That’s putting it nicely. What’s happened is you’re showing users the wrong way to do something without it being
by jarym 8y ago
> Sometimes things get simplified in tutorials
That’s putting it nicely. What’s happened is you’re showing users the wrong way to do something without it being explicitly clear to them. Then we wonder why people write crap code...
My view is NEVER simplify an example to the point it becomes a security or performance hazard.
What this tells me now is that this projects examples are not useable, their agenda is to make things appear easy when in fact concrete examples may not be.
- abraham_lincoln 8y agoI am quite certain, regardless of language, a good developer would be aware that input for a DB needs to be sanitized.
- hobofan 8y agoAnd what about all the none-"good" developers? There are also frameworks that do the sanitization for you (e.g. Rails IIRC), and novice developers coming from those certainly might not be aware.
- jarym 8y agoEqually, one could argue a 'good' developer would not in any way be put off by an example that demonstrated good security practice. And 'good' needs to be put in context: e.g. a 'good' hardware or kernel engineer who never wrote front-end stuff may legitimately be unaware of the need to defend against SQL injection unless its written somewhere. If they're as 'good' as you're expecting they would probably not even require a getting started tutorial... Anyway, this is something I see in many tutorials and its somewhat unfair to single out Lucee. I just wish tutorial writers would put effort into real-world examples more often.