5 ms·
Looks like a poorly designed method to avoid SQL injections.
by PhearTheCeal 13y ago
Looks like a poorly designed method to avoid SQL injections.
- gibybo 13y agoDoubt it - if I remember correctly, News uses its own storage engine (written on top of the file system) rather than a SQL database. Source at http://arclanguage.org/install http://arclanguage.org/install
- pigscantfly 13y agoEven if it's not SQL oriented, it could still be to mitigate some kind of injection attack. This is an interesting question; I hope someone with more specific knowledge takes the time to answer it.
- stevelosh 13y agolike foo.com'onclick="alert('hi');" But yeah the right way to do this is to use a well-tested urlencoding library, not to strip out dangerous-looking characters.
- johnrob 13y agoIt might be effective though. An occasional 'Ask PG' is better than an occasional security breach.
- jfb 13y agoI was under the impression that HN was completely invulnerable to SQL injection?
- ukd1 13y agoIt doesn't use 'database' but still has openings, it's just code afterall. FYI: security breach != sql injection.
- mistercow 13y agoYes, but wouldn't escaping the URL properly be a better solution than either?
- kogir 13y agoNope. No SQL here. Not to be confused with NoSQL.
- staunch 13y agoOr whether or not you know SQL
- jafaku 13y agoYeah, it's about time we admit HN is pretty disastrous.
- unono 13y agoPG didn't use SQL. Not sure why, I would love an explanation from PG himself. He's a great programmer and can teach us something while explaining his reasoning.
- fnordfnordfnord 13y agoHe did explain that at least once here. Someone brought it up about six months ago when they updated to the new Altair. Here is a related discussion from around that time. Sorry I couldn't find the one from PG. https://news.ycombinator.com/item?id=5239673 https://news.ycombinator.com/item?id=5239673 IIRC HN runs off a flat file, and doesn't use SQL, or anything else fancy simply because it isn't needed, and or because it adds unneeded complexity.
- unono 13y agoThanks, looks good. HN was built before heroku and app engine then. Nowadays, putting a db-backed site on them is pretty easy zero-admin affair.