Out of curiosity, what makes 42030 better than MB Arocs (42043) or Mobile Crane II (42009)? I was just looking for a gift for myself a week ago, and 42043 looks great.
1,260 karma · joined November 2, 2009
PHP has an inactive proposal to implement it as well [2].
Note that PHP also has a JavaScript-style triple-equals comparison, which does not attempt type conversion and does not exhibit this bizarre behaviour.
So people who use
"WHERE id=" . $_GET['id']
Another scenario I just thought of: your schema is more or less dynamic. For example, Drupal lets developers/site administrators create entities with custom fields, each field gets its own DB table, and to load an entity you need to
SELECT * FROM node
LEFT OUTER JOIN field_data_field_name_1 ON ..
LEFT OUTER JOIN field_data_field_name_2 ON ..
...Anecdote: I was integrating a paid Magento extension (which charges about $1000 for a license) into an existing shop, and some poor code in their templates made me look deeper into their main code. Six hours later, I had:
* 4 different ways to read any file on the server that PHP can read,
* 5 different ways to upload any file to a certain directory on the server, including one that lets you overwrite the webserver's security configuration for that directory and then execute uploaded PHP code,
* a way to delete certain things the administrator has created in the backend,
* a way to overwrite other customers' uploaded files,
* a way to edit other customers' information, which lets you then XSS/XSRF those customers when they view that information.
I have reviewed other Magento extensions in the past, and I found many poor ones, but nothing as atrocious as this.
> V8 version 5.6, which will be in beta until it is released in coordination with Chrome 56 Stable in several weeks...
> Starting with 5.6, V8 can optimize the entirety of the JavaScript language.
You might also want to check your browser settings to see which domains have saved cookies, saved passwords, or the "never save passwords on this domain" flag.
You're face to face
With the man who sold the world
Judging from the URLs, it seems that each action is handled by a different standalone script. This is very common in legacy code bases, and it typically (not always) means that:
1) all those scripts need the same bootstrapping boilerplate copy-pasted into them, which is a maintenance nightmare. Even if you simplify it to one or two lines of boilerplate that includes a central boostrap file (or use some configuration magic to automatically run an additional script before the script you requested), it's still worse than having a single centralized entry point that handles routing, auth, and so on. There's always a chance that someone forgets or botches an auth check in one of these files and it goes unnoticed.
2) you will probably be able to make an HTTP request directly to some file that was not intended as an entry point (the author mentions header.php – this is a perfect example), and then who knows what happens, because you never planned for this and your bootstrap code doesn't run and possibly variables expected by that script are not defined, or errors thrown by the script are not handled by a pretty error handler... kinda like doing an assembler jmp into the middle of another function, after any sanity checks it might have had.
3) I have been working with PHP for 8 years now, and almost inevitably, where this pattern shows up, there's most likely outdated and insecure practices like SQL queries from string concatenation (leading to SQL injection) or unescaped HTML output (leading to XSS, XSRF, or other security problems). It's basically an "easy target" sign for hackers.
Front Controller pattern [1] is a recommended alternative.
See also: Perl has a "taint mode" [1] which marks all variables receiving external data as "tainted" and disallows their usage in sensitive contexts. PHP has an inactive proposal to implement it as well [2].
I tried to build something like that for rendering HTML, for the same reasons – security and proper structure. But, stupidly, I was working in PHP, and so its syntax was somewhat clunky. I still think it is a good idea, though.
The Worms series is also notorious for this. Their AI targeting seems to flip between "clueless" and "godlike", with very little middle ground. E.g. https://youtu.be/gqPITW04vRQ?t=1m20s
2. One customer requested the ability to enter decimals in a field, but to keep up/down spinner in steps of whole numbers. You can't do that, the step attribute makes any values other than (min + N * step) invalid. I can see some sense in that, but I think the step attribute should only affect the increments/decrements done by the spinner, not completely reject certain values. (Though you can use step=any to mark all values valid and step by 1.0, which is good enough for common cases.)