3 ms·
The thing is, it's easier to do it the right way. It requires a special, deliberate effort to do it wrong. That seems like a reasonable implementation of a "mag
by RyanMcGreal 16y ago
The thing is, it's easier to do it the right way. It requires a special, deliberate effort to do it wrong. That seems like a reasonable implementation of a "magic" feature. PHP, as usual, gets it exactly backwards. It's easier to do it wrong, and requires a special, deliberate effort to do it the secure way.
- rapind 16y agoYeah maybe. Depends on the person I think. I actually find it easier to assemble a SQL string myself. If you're new to rails / AR and you're not familiar with SQL then you'll look up and figure out how to assemble the SQL via the ORM methods. If you're new to rails but an old hand at SQL, just building the string is super easy and takes you 2 seconds without looking up any documentation. Of course assembling the string AND sanitizing it requires a heck of a lot more effort. Regardless, it's not a knock on rails. Just saying it's not necessarily a magic bullet to secure apps (and I don't believe rails nor PHP needs to be).