Hacker News Reader

Comment by nosefrog | Hacker News Reader

Thank you! Your project was helpful to skim through. Do you have any additions to the web-project-bootstrap.rkt project?

BTW, this is what I mean by form bindings being confusing: according to the docs, request-bindings is dangerous and shouldn't be used http://docs.racket-lang.org/web-server/http.html#%28mod-path... . That's kind of confusing, because request-bindings is used in the tutorial docs: http://docs.racket-lang.org/continue/#%28def._%28%28lib._web...

And the function that Matt Might uses, request-post-data/raw, isn't even in the docs! Haha, so handling forms has been a bit of a pain for me :)

View on HN

Good to know! I followed the tutorial and they were using it there, and didn't see the docs after that. I see that the Matt's blog handles the problem with request-binding himself, by doing ensuring encoding conversions, and gets over the file uploading problem. So I would replace my code with the way he does.

For your boilerplate, you may want to add bunch of options to serve/servlet such static files path, stateless? (to not use continuations) etc...

The problems are not really Racket specific. They arise from trying to validate, parse, and execute upon the arbitrary input that can be passed in request bindings. The fact that all values are turned into lower case bit my as I worked on my first web-app. Getting bit by a cross site scripting [XSS] attack would have been worse. There's just a lot of work that goes into producing production quality webb apps when the app is worth producing that can't be covered in a tutorial. The Continue tutorial is a high level overview of the tools Racket provides (e.g. interfacing with persistant storage). The More tutorial gets deeper under the hood and covers dispatching on URI's with a server. Dispatching is generally going to provide simpler contexts for dealing with user data.

The request-post-data/raw function is in the docs: http://docs.racket-lang.org/web-server/http.html?q=post-data...

request is a struct with the field post-data/raw, so this implies that request-post-data/raw can access the field.

http://docs.racket-lang.org/web-server/http.html?q=request#%...

Reply on news.ycombinator.com