Hacker News Reader

Comment by viraptor | Hacker News Reader

I think the questions imply one side of the argument. I thought there's one reasonable side to this argument. Then I was a stubborn person one day. Why?

Because someone wrote an SQL query with string interpolation of variables and no escaping. Why? Because the values at that time were actually coming from a limited set and were safe to provide that way. Yet I argued that it should be a prepared query anyway, so that we avoid it potentially exploding in the future.

Was he right that it doesn't matter at the time - yes. Would I be the annoying, stubborn, difficult person who knows better again in a similar situation? Yes! And I know some people will be angry about it while others will agree with me. That's life.

View on HN

There's a whole range of possibilities here. Sometimes you get the strong-willed person who has perfectly sensible arguments and may even be fully technically correct, but for non-technical reasons you can't go with their choice, and that really bothers them. Sometimes you get the strong-willed person who has a choice in mind, and doesn't have strong reasons, just strong opinions. Sometimes you have the person who thinks they know the right answer, but a senior person is fighting with them because their experience tells them there's still a problem tomorrow even if it's all fine today. And sometimes you've got someone who is the very definition of fair and rational fighting you tooth and nail because you are trying to do something very, very stupid.

And sometimes you've just got yourself an asshole.

It can be hard to tell which is which from someone's self-report. Presumably hoodoof (the original poster) has one or more people in mind which prompted hoodoof to write this, but from a one-sided view we really can't tell which is which.

Of course, in the end, I'm not aware of any career path which is populated solely by happy, healthy, well-balanced people that everyone loves to spend time with. Not even therapists or the clergy.

Well said.

If the world went on following that agreement, then (I doubt?) you're the kind of person that the OP is talking about. If you had that disagreement and then let it color your team interactions for the next week, if you couldn't let it go, and if you harped on it for the next several weeks, then you'd probably be the annoying and difficult person.

Working with other people means obvious disagreement, and sometime your disagreement will be productive and cause change, and other times it won't. Theres a lot of people who cross the fine line of productive discourse and unproductive disagreement though, and there's some people that seem to thrive on the other side of that line in this industry -- I imagine that's the attitude that a lot of people find off-putting.

> Because someone wrote an SQL query with string interpolation of variables and no escaping. Why? Because the values at that time were actually coming from a limited set and were safe to provide that way. Yet I argued that it should be a prepared query anyway, so that we avoid it potentially exploding in the future.

I'm curious if you had coding standards (internally developed, or adopted from another party / standard) that stated best practice?

In my experience, an objective standard is really important in these discussions. If you did, and they wanted to avoid it, was it referred to? If you didn't, was developing a standard taken as a learning point to be adopted in the future, or not pursued?

It was a helper script rather than an existing project, so it was in the "unregulated" region It's hard in my experience to have a coding standard that's team-wide, cross-project and doesn't get in the way. But you're right that parametrised queries could be one requirement that you have to keep.

I think that's an excellent issue to be stubborn about. Even if the string interpolation didn't matter in that situation, whatever alternative you were using, an orm or prepared queries, must have been equally convenient. So the reason your colleague used string interpolation must have been because he didn't knew about the better alternatives. Then insisting on him refactoring his code to use prepared queries is correct because for a small time-investment he learns to use the correct api:s and can write better quality code in the future.

The "SQL query with string interpolation from a limited set" argument is a tough one and usually happens when dealing with younger or more junior devs. Someone, please provide a script of criticism that lets the junior dev save face!

Reply on news.ycombinator.com