Hacker News Reader

hey feel free to checkout the golang code here https://github.com/activityclub/pointspaced it's way more versatile than sql for our needs. BTW the #{id} we call .to_i on it first so ruby will make that 0 if it's a string with a single quote or something.

View on HN

I've had only a cursory look, but it really feels as if you're reinventing database indices.

Indices are based on the same logic, i. e. "99% are reads, let's try to do more work on writes".

Redis is great. But to be honest: so is MySQL. If you give MySQL enough RAM and create the right indices, you can easily get to 6-digit numbers of queries per second.

https://news.ycombinator.com/item?id=14500889

That sounds like a recipe for disaster, if that's the only thing you're relying on for input validation of #{id}.

what do you mean. "wefwkefjwe'".to_i will goto zero every time. How is sql injection possible if I to_i your string?

Wouldn't it be better to not even run the query if id is a non-integer value, or does id = 0 have some intrinsic meaning in your data?

Reply on news.ycombinator.com