Hacker News Reader

Comment by PhearTheCeal | Hacker News Reader

Looks like a poorly designed method to avoid SQL injections.

Doubt it - if I remember correctly, News uses its own storage engine (written on top of the file system) rather than a SQL database. Source at http://arclanguage.org/install

Even if it's not SQL oriented, it could still be to mitigate some kind of injection attack. This is an interesting question; I hope someone with more specific knowledge takes the time to answer it.

like foo.com'onclick="alert('hi');"

But yeah the right way to do this is to use a well-tested urlencoding library, not to strip out dangerous-looking characters.

PG didn't use SQL. Not sure why, I would love an explanation from PG himself. He's a great programmer and can teach us something while explaining his reasoning.

He did explain that at least once here. Someone brought it up about six months ago when they updated to the new Altair. Here is a related discussion from around that time. Sorry I couldn't find the one from PG. https://news.ycombinator.com/item?id=5239673

IIRC HN runs off a flat file, and doesn't use SQL, or anything else fancy simply because it isn't needed, and or because it adds unneeded complexity.

Thanks, looks good. HN was built before heroku and app engine then. Nowadays, putting a db-backed site on them is pretty easy zero-admin affair.

Nope. No SQL here.

Not to be confused with NoSQL.

Or whether or not you know SQL

It might be effective though. An occasional 'Ask PG' is better than an occasional security breach.

Yes, but wouldn't escaping the URL properly be a better solution than either?

I was under the impression that HN was completely invulnerable to SQL injection?

It doesn't use 'database' but still has openings, it's just code afterall. FYI: security breach != sql injection.

Yeah, it's about time we admit HN is pretty disastrous.

Reply on news.ycombinator.com