Hacker News new | ask | show | jobs
by sirfried 5121 days ago
how lame, do AR devs need someone to remind them about bind variables/params ?
2 comments
Robin_Message 5120 days ago
(rant) Since Rails devs don't appear to believe in databases (and to be fair, if I was targeting MySQL version 3 I'm not sure I would believe in them much either), they don't bother using database features for binding. Instead having their own half baked (well, it 90% baked now, but it still has the occasional squishy bit) binding system.

Same for validations, foreign keys, primary keys, indexes, enumerations, etc. (/rant)

link
benmmurphy 5120 days ago
the places where these sql injections were happening wouldn't be prevented from traditional sql bindings which are applied to parts of the where clause or set values. in JDBC land i don't think you can do "SHOW TABLES FROM ? WHERE ...."
link
amalag 5120 days ago
Binding variables is prepared statements? AR does support that, how does that affect this vulnerability?
link