3 ms·
I don't really hate any language, but i have a few dislikes: 1) PHP - for inconsistency and security bugs (did you know, that you can inject into mongodb with
by mike_esspe 16y ago
I don't really hate any language, but i have a few dislikes:
1) PHP - for inconsistency and security bugs (did you know, that you can inject into mongodb with PHP? :)
2) Perl - for write only style.
3) C/C++ - for manual memory management and subtle bugs, which manifest itself long after actual bug happens (once i was searching for a rare-triggered bug in the C server for several months).
4) Java - for over-engineered APIs and verbosity.
- cheald 16y agore: 1), I assume you mean by passing an array with $operators into code that gets executed naively? If so, that's not just a Ruby problem; it's possible in any language, especially if you're working with a framework that automatically parses query variables and you don't typecheck/typecast before passing user data to your database.
- mike_esspe 16y agoNope, PHP silently converts URL parameters into arrays (and if you don't expect this, than you can get a nasty NOSQL inject) http://www.php.net/manual/en/mongo.security.php http://www.php.net/manual/en/mongo.security.php
- cheald 16y agoYeah, that's a problem in lots of languages/frameworks. Rack automatically parses URL parameters like that, too. The solution is to cast your parameters to a string before using them.