Doc Avid Mornington

Not actually a doctor.

  • 0 Posts
  • 93 Comments
Joined 1 year ago
cake
Cake day: July 5th, 2023

help-circle


  • I mean, that’s just a bad library interface. With a halfway decent interface, you can do something like

    query('insert into foo (status, name) values (:status, :name)', ent)
    

    No orm required. With tagged templates in JS, you can do

    q`insert into foo (status, name) values (${ent.status}, ${ent.name})`
    

    Even wrap it in a function with destructuring to get rid of ent:

    const addFoo = (q, {status, name}) =>
        q`insert into foo (status, name) values (${status}, ${name})`
    

    Typescript can add type safety on top of that, of course. And there’s the option to prepare a query once and execute it multiple times.

    Honestly, the idea of manipulating XML queries, if you mean anything more fancy than the equivalent of parameter injection, sounds over-complicated, but I’d love to see a more concrete example of what you mean by that.


  • Postgres has the having clause. If it didn’t, that wouldn’t work, as you can’t use aggregates in a where. If you have to make do without having, for some reason, you can use a subquery, something like select * from (select someCalculatedValue(someInput) as lol) as stuff where lol > 42, which is very verbose, but doesn’t cause the sync problem.

    Also, I don’t think they were saying the capability having gives is bad, but that a new query language should be designed such that you get that capability without it.










  • The only way they will “see the light” is if they look around their states and see no women; see no educated individuals; see no hard working youths; and see no business

    I mean, they won’t “see no women”, women are nearly as likely to support forced birth as men. They don’t really care about the rest of that. They’d be quite glad to not have any opposition anymore, and be able to keep all those juicy senate seats and electoral college votes. Since they already have created an extremist Supreme Court, this would guarantee they wouldn’t lose the ability to veto or filibuster any attempt to fix it, while said Court continues to impose their views on the rest of the country.



  • The thing is, I don’t really care what people “deserve”, or what they “don’t deserve”. How should I know? I’ll be a dork and quote Tolkien: “Many that live deserve death. Some that die deserve life. Can you give it to them, Frodo? Do not be too eager to deal out death in judgment.”

    But I do care about who’s in the pact. We have an agreement, between us, we decent people. We watch out for each other. We protect each other. Or if we can’t, when something terrible is done to somebody, at the very least, we speak out, in protest, in sympathy, in sorrow. And the people covered by this pact, as far as I’m concerned, are the people who follow it - that’s it, the sole criteria for membership, about the lowest bar possible.

    I’m not going to force somebody to carry a dead fetus because they forced other people to do so, but when the cruel laws they always thought would only apply to other people suddenly apply to them, I don’t owe them my sympathy either. They aren’t in the pact.





  • I’m not sure how including a final semicolon can protect against an injection attack. In fact, the “Bobby Tables” attack specifically adds in a semicolon, to be able to start a new command. If inputs are sanitized, or much better, passed as parameters rather than string concatenated, you should be fine - nothing can be injected, regardless of the semicolon. If you concatenate untrusted strings straight into your query, an injection can be crafted to take advantage, with or without a semicolon.