3 ms·
I am quite certain, regardless of language, a good developer would be aware that input for a DB needs to be sanitized.
by abraham_lincoln 8y ago
I am quite certain, regardless of language, a good developer would be aware that input for a DB needs to be sanitized.
- hobofan 8y agoAnd what about all the none-"good" developers? There are also frameworks that do the sanitization for you (e.g. Rails IIRC), and novice developers coming from those certainly might not be aware.
- jarym 8y agoEqually, one could argue a 'good' developer would not in any way be put off by an example that demonstrated good security practice. And 'good' needs to be put in context: e.g. a 'good' hardware or kernel engineer who never wrote front-end stuff may legitimately be unaware of the need to defend against SQL injection unless its written somewhere. If they're as 'good' as you're expecting they would probably not even require a getting started tutorial... Anyway, this is something I see in many tutorials and its somewhat unfair to single out Lucee. I just wish tutorial writers would put effort into real-world examples more often.