4 ms·

Things like this makes me once again appreciate languages with a static type-system. Not in any way claiming they guarantee bug- or exploit-free code, but these

• pixelbath 17y ago
  Which language with a static type system accepts statically-typed variables via querystring?
  • trezor 17y ago
    The query-string is (obviously) a string and there is no way to treat it as anything else in a static type system. But in a static type system you will have to cast or convert query-string data to whatever you want them processed as before you can use them as anything besides plain strings. If you want it to be an int, convert it. If you want it to be a datetime, convert it. If you want it to be an array of whatever, convert it. If the data is not in the expected format (like in this case), the conversion will fail. In this example we saw how modifying one query-string parameter had effects down to the signature of a function. Something like that will never happen in a static type system.
    • deleted 17y ago
      [deleted]