4 ms·
String interpolation. It can be used for good but it’s possible to exploit if the user picks the string. Many languages have exactly the same feature: Python:
by KMnO4 6y ago
String interpolation. It can be used for good but it’s possible to exploit if the user picks the string. Many languages have exactly the same feature:
Python:
f”Price: {get_price()}”
JavaScript:
`Price: ${get_price()}`
Notice how both Python and JS require more than just double quotes; you have to explicitly opt in with f-strings or template literals.
- tyingq 6y agoIt was Ruby's use of the # character for interpolation that was throwing me off. Apparently you can skip the braces too, if the # precedes some types of variables.
- burlesona 6y agoRuby is also opt-in in the sense that single quoted strings do not support interpolation, and while the language doesn’t care if you use single or double quotes, most linters will enforce single quotes as the default.