Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't really hate any language, but i have a few dislikes:

1) PHP - for inconsistency and security bugs (did you know, that you can inject into mongodb with PHP? :)

2) Perl - for write only style.

3) C/C++ - for manual memory management and subtle bugs, which manifest itself long after actual bug happens (once i was searching for a rare-triggered bug in the C server for several months).

4) Java - for over-engineered APIs and verbosity.



re: 1), I assume you mean by passing an array with $operators into code that gets executed naively? If so, that's not just a Ruby problem; it's possible in any language, especially if you're working with a framework that automatically parses query variables and you don't typecheck/typecast before passing user data to your database.


Nope, PHP silently converts URL parameters into arrays (and if you don't expect this, than you can get a nasty NOSQL inject)

http://www.php.net/manual/en/mongo.security.php


Yeah, that's a problem in lots of languages/frameworks. Rack automatically parses URL parameters like that, too. The solution is to cast your parameters to a string before using them.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: