3 ms·
Oh god, this. The best part is that by externalising querying, it becomes fiddly to support every possible query shape… so… … inevitably: public object G
by jiggawatts 2y ago
Oh god, this.
The best part is that by externalising querying, it becomes fiddly to support every possible query shape… so…
… inevitably:
public object GetSQL( string query ) …
SQL injection is the inevitable end result of this design pattern.
- hinkley 2y agoBecause they get tired of babysitting two sets of PRs and deployment pipelines for every feature and some of the bug fixes. So I’ll just make the service “generic” to stop having to keep changing the service. Brilliant! Pain is information, but some people take the wrong actions based on that information.
- jiggawatts 2y agoThis was in a single repo, but the problem is the same: There is an impedence mismatch between SQL queries and typical RPC APIs such that it becomes decidedly non-trivial to represent every possible arbitrary query "shape" that might occur in a report. Picture the kind of queries that might be generated by something like an embedded Crystal Report or a Power BI report web control. You can get all sorts of group-by operators, top-n sorts, sums, min/max/avg, etc...