Hacker News Reader

Comment by sean_patel | Hacker News Reader

#DeveloperFail

Funny, the page asks for your name, and if you have ' like Irish names, it marks the name in Red (invalid) and doesn't let you move forward with finding out the books.

I tested it with the following names.

James O'Keefe

Mullah O'Mar

View on HN

Why can't a name simply be a string of length X? All this work of checking for "correct" names is so pointless.

Badly written SQL generation often prompts single quotes being forbidden in input. "Having single quotes there breaks my queries," one sometimes hears said. "I don't know why."

This is a great opportunity to mentor one's juniors. An injection attack is trivial to demonstrate in the local dev environment, and the result strongly motivates anyone worth working with to learn how not to do that again.

For the 10,000 who might be learning about this today, the answer is prepared statements with placeholders for the values, like this pseudocode:

   stmt = driver.prepare("insert into names 
      (firstname, lastname) values (?, ?)");
   stmt.execute("Flannery", "O'Connor");

Syntax varies among database interfaces but this ensures that any odd strings are properly stored by the driver and the application does not need to worry about them. There is also no risk of someone rewriting the SQL statement.

Same for äöü. Dev hates foreigners obviously

Getting names right is very hard: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

No, getting names right is incredibly simple. It's a single unicode `name` field, stored however your language/db stores unicode. E.g.:

    name: [person's name]

No minimum lengths (other than != 0) and a reasonably large maximum length for your db (only to protect against DoS attacks). Accept all input (into properly prepared SQL statements).

Reread the list with your assumptions in mind (one nonzero-length field, with a maximum field, Unicode).

Sounds like a very hacky way to avoid little Bobby Tables...

But it also forbids characters like ñ or í

Why the downvotes? Sorry for calling it out, but it is indeed a #DeveloperFail. We (developers) have egos bigger than doctors and lawyerys, is that why everyone is downvoting a legitimate assertion with proof? (and more proof in comments to my original comment )

Reply on news.ycombinator.com