Hacker News Reader

Comment by emil0r | Hacker News Reader

Which means a) You're going to forget it at least once. b) For every developer mindful of this, there will be hundreds not knowing about it.

If you ever put "you just need" into a sentence about security you've already lost.

View on HN

> a) You're going to forget it at least once.

Which is why you should never process raw input in multiple places in your app. One method I've used for over a decade of webdev in any language: there's only one place to get the input from, and that place requires you specify what input is allowed.

Any security practice that addresses an insecure default state by starting with "you should never..." is doomed.

The default Rails way of using Activerecord will automatically sainitize inputs for you. Not turning it into an associative array doesn't add anything to security.

User input need to be sanitized always. Rails make it easy and is the default way.

All true. I was thinking of the submitted link still. Manually sanitizing instead of having something doing that for you is a bad idea because you will forget.

There's nothing stopping you from passing unsanitized params to the database. I.e. where("name LIKE '%#{params[:name]}%'") instead of where("name like ?", "%#{params[:name]}%"). While the 2nd option is definitely the recommended way to do it, there's nothing stopping you from doing it the wrong way, and I bet many do.

The thing is, it's easier to do it the right way. It requires a special, deliberate effort to do it wrong. That seems like a reasonable implementation of a "magic" feature. PHP, as usual, gets it exactly backwards. It's easier to do it wrong, and requires a special, deliberate effort to do it the secure way.

Yeah maybe. Depends on the person I think. I actually find it easier to assemble a SQL string myself. If you're new to rails / AR and you're not familiar with SQL then you'll look up and figure out how to assemble the SQL via the ORM methods. If you're new to rails but an old hand at SQL, just building the string is super easy and takes you 2 seconds without looking up any documentation. Of course assembling the string AND sanitizing it requires a heck of a lot more effort.

Regardless, it's not a knock on rails. Just saying it's not necessarily a magic bullet to secure apps (and I don't believe rails nor PHP needs to be).

The "hundreds not knowing about it" was was sparked me to submit this to HN. This is important stuff and probably should not be relegated to a php.net footnote.

Edit: It's not actually a footnote -- it's actually just the only item on the lonesome "Security" page.

To be fair, it's the Mongo Security page, not the general security page, which can be found here: http://www.php.net/manual/en/security.php

The web is full of these kinds of issues -- you need to escape, filter, etc, etc, every piece of user data. You either do it yourself or use some kind of abstraction layer (template engine, ORM, etc) to do it for you.

Put differently: "we're all doomed". Squares with our professional experience.

Reply on news.ycombinator.com