4 ms·

sure, sometimes, rarely -- these are exceptions, not rules in general, it should not be possible for user input to produce arbitrarily complex queries against

sure, sometimes, rarely -- these are exceptions, not rules in general, it should not be possible for user input to produce arbitrarily complex queries against your database each input element in an HTML form should map to a well-defined parameter of a SQL query builder, like, you shouldn't be dynamically composing sub-queries based on the value of a text field, the value should add a where or join or whatever other clause to the single well-defined query sometimes this isn't possible but these should be super rare exceptions

Daishiman 3y ago
I prefer using something like Rails or Django to build 10 fully working CRUD interfaces with well-defined yet dynamic filters in a day instead of spending two weeks needlessly writing the equivalent code by hand.
- preseinger 3y ago
  why would it take you two weeks to write 10 SQL simple queries?
  - Daishiman 3y ago
    10 simple CRUDs you mean? With dynamic filters, admin UI, auth, tables, and so on? Because these frameworks allow you to do that in a single day.
    - preseinger 3y ago
      i'm running out of ways to say that a CRUD endpoint should not have dynamism in the sense that you mean /users/:id should map to 1 endpoint that's parameterized on userid /search?userid=:userid&tag=:tag should map to 1 endpoint that's parameterized on userid and tag(s) endpoints should be simple to write
      - kaba0 3y ago
        Yeah and programs should also be simple, but there would be no value to them that way.
      - ehutch79 3y ago
        You’ve never actually implemented a real world implementation, have you? You’re going to have parameters that are compound. You’re going to end up filtering on objects 3 relations removed, or deal with nasty syncing of normalization. You’ll have endpoints with generic relations, like file uploads, where the parent isnt a foreign key. It’s going to be a mess. They will NOT always be simple to write.
jupp0r 3y ago
Have you ever heard of APIs?

Daishiman 3y ago

I prefer using something like Rails or Django to build 10 fully working CRUD interfaces with well-defined yet dynamic filters in a day instead of spending two weeks needlessly writing the equivalent code by hand.

preseinger 3y ago
why would it take you two weeks to write 10 SQL simple queries?
- Daishiman 3y ago
  10 simple CRUDs you mean? With dynamic filters, admin UI, auth, tables, and so on? Because these frameworks allow you to do that in a single day.
  - preseinger 3y ago
    i'm running out of ways to say that a CRUD endpoint should not have dynamism in the sense that you mean /users/:id should map to 1 endpoint that's parameterized on userid /search?userid=:userid&tag=:tag should map to 1 endpoint that's parameterized on userid and tag(s) endpoints should be simple to write
    - kaba0 3y ago
      Yeah and programs should also be simple, but there would be no value to them that way.
    - ehutch79 3y ago
      You’ve never actually implemented a real world implementation, have you? You’re going to have parameters that are compound. You’re going to end up filtering on objects 3 relations removed, or deal with nasty syncing of normalization. You’ll have endpoints with generic relations, like file uploads, where the parent isnt a foreign key. It’s going to be a mess. They will NOT always be simple to write.

jupp0r 3y ago

Have you ever heard of APIs?