4 ms·
The other funny thing is this bit: > Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom
by GongOfFour 6y ago
The other funny thing is this bit:
> Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom that protects against SQL injection attacks.
That's not true at all. If you are going to do technical analysis that calls out mistakes, the publication should have multiple technical people review the article.
- lilyball 6y agoI had the same reaction, but upon reflection, the reject/filter actions themselves aren’t what’s safe, it’s the usage of functions that accept unsanitized input and safely wrap the SQL that’s going on here.
- theptip 6y agoUnfamiliar with Ruby/Rails, why's that untrue? Is it because `reject` / `filter` are just array mapping functions rather than ActiveRecord methods? (Best explanation I could come up with on a quick skim.)
- tinco 6y agoYeah, at a glance it seems they had a performance problem, possibly from their use of reject and filter which you correctly guess operate over the results instead of becoming part of the query. I'm guessing he was not familiar with the codebase and maybe not even ruby/rails in general and just wrote the whole sql query by hand, not bothering to figure out the correct way of parametrization , using string interpolation instead.
- xref 6y agoCome on man, don’t just comment “the article is wrong” then walk away. Put in some effort.