Our New Observability Platform for 100B Logs

blog.railway.app

11 pointscreativedg3 comments

Nice launch!

The SQL snippet shared [1] gives me the heebie jeebies. If any one of those where clauses contains user-generated data, that's ripe for a SQL injection vulnerability. `fmt.Sprintf` and SQL almost never belong together.

1 - https://blog.railway.app/_next/image?url=https%3A%2F%2Fres.c...

Don't worry, the generated "whereClauses" also contain replacement markers (values contained in "params") so everything gets escaped correctly.

Hey, OP here! We just spent the past 8+ months rebuilding our DIY logging stack on top of ClickHouse. Happy to answer any questions!

Reply on news.ycombinator.com