The Daily WTF: Curious Perversions in Information Technology

John Bigboote · 2006-08-22 Reply Admin

Anonymous:
so of course the fix was to put:

if (sLogin == "O'Reily") sLogin = "O''Reily";
if (sLogin == "Robert O'Hare") sLogin = "Robert O''Hare";

maybe we could create a funcion to look for "O'" and replace it with "O''"!!!

done!

D'oh!

Bus Raker · 2006-08-22 Reply Admin

Anonymous:
Bus Raker:
richleick:
Alex Papadimoulis:
When developing an application that uses in-line SQL queries, it's essential to protect against "SQL Injection", i.e. the insertion of SQL code as a result of a string concatenation. For example, if productNum comes directly from user input, it might contain a malicious string, such as "'; DROP DATABASE --"
myQuery = "SELECT Prod_Name FROM Products WHERE Prod_Num='" + productNum "';";
The best way to do this is through "parameterized queries," which lets the database libraries take care of it. The next best way is to write your own escaping functions. And the next best way is to replace all instances of "O'Reily" with "O''Reily".
Close. Add the use of stored procedures and I'm all for it. Oh wait, that would mean if you are using an earlier version of MySQL you probably never heard of these.
Uh ... I think parameterized queries = stored procedures. Is there another kind I don't know about?
uh?...

parameterized queries != stored procedures

Sorry ... I'm only a product of my experience, which has been that all database involvement through an application happens via stored procedures. How else can you control security at the action level?

mugs · 2006-08-22 Reply Admin

Anonymous:
Anonymous:
DZ-Jay:

There are certainly other frameworks for developing web applications apart from ASP or PHP, and some of them focus on RAD, some of them even better, faster, and more robust and secure than your precious ColdFusion. But I most definitely wouldn't call ColdFusion a "Real Programming Language".

-dZ.

Name one.

Ruby.

on
Rails

That was my first thought, although I've never used it.

2006-08-22 Reply Admin

Russ:

Seriously. I dare you. Name one other programming language that even comes close to CF in terms of RAD.

Logo. Logo is RAD.

Irrelevant · 2006-08-22 Reply Admin

Anonymous:
Anonymous:
Name one... Seriously. I dare you.
Ruby.

Excuse me sir, the maitre d' sent me over... he asked me to pass on this message... *ahem*

YOU GOT SERVED!

...to be serious for a moment, I think the mistake was in saying "real web programming language" at all. IMO, ColdFusion looks more like a "templating language". It's advanced as those go, yes, but you can't expect calling an XML-based language a "programming language" to be taken seriously.

2006-08-22 Reply Admin

Anonymous:

Such as? I can write any stored procedure inside a CF query, and it will probably run in about the same time if I use parameters to call it. Other then speed, what other benefits are there?

If you're using SQL Server, the difference in execution time is true for older versions (pre-7.0 I believe). In current versions the execution plan is cached for ad-hoc queries, almost eliminating the difference in execution time.

If you're performing a "bulk insert" without using the bulk insert command (most DBA's will disable this because it places a lock on the entire table) by repeatedly calling INSERT, it would be more efficient to pass the entire SQL text than to iteratively call a stored procedure.

To me, the benefit comes in having all direct table access logic separated from the code. If something needs to be changed in a SQL script, only the stored procedure needs to be deployed. Also, if you're lucky enough to have no exceptions that require straight SQL, you can grant users only execute permissions to the stored procedures, so there's no ad-hoc queries that lock important tables or perform data manipulation that you haven't explicitly allowed. In a word, abstraction.

To wrap it up, if you need to find out which queries access a specific table (because you're about to add a required column, or whatever reason) you just need to grep the directory(ies) that contain the stored procedure scripts. You can also have multiple applications that use the same stored procedures, and for some reason it's not practical for these apps to use the same data access layer.

2006-08-22 Reply Admin

Anonymous:
Simple, ban the Irish and the Scots.

Or at least the ones that were rich enough to make it through the depression

John Bigboote · 2006-08-22 Reply Admin

Anonymous:
To wrap it up, if you need to find out which queries access a specific table (because you're about to add a required column, or whatever reason) you just need to grep the directory(ies) that contain the stored procedure scripts. You can also have multiple applications that use the same stored procedures, and for some reason it's not practical for these apps to use the same data access layer.

Or, if you're using SQL Server, you can use sp_depends, which will tell you about ALL procs hitting a particular table regardless of where their create scripts are.

richleick · 2006-08-22 Reply Admin

Anonymous:
Bus Raker:
richleick:
Alex Papadimoulis:
When developing an application that uses in-line SQL queries, it's essential to protect against "SQL Injection", i.e. the insertion of SQL code as a result of a string concatenation. For example, if productNum comes directly from user input, it might contain a malicious string, such as "'; DROP DATABASE --"
myQuery = "SELECT Prod_Name FROM Products WHERE Prod_Num='" + productNum "';";
The best way to do this is through "parameterized queries," which lets the database libraries take care of it. The next best way is to write your own escaping functions. And the next best way is to replace all instances of "O'Reily" with "O''Reily".
Close. Add the use of stored procedures and I'm all for it. Oh wait, that would mean if you are using an earlier version of MySQL you probably never heard of these.
Uh ... I think parameterized queries = stored procedures. Is there another kind I don't know about?
uh?...

parameterized queries != stored procedures

At least someone (i.e. BlackTiger) knows what the $%$# they are talking about. I think we have stumbled upon one of the main reason's this site exists. Instead of teaching basic principals (e.g. data structures, object oriented principals, database fundamentals, etc.) programmers (if they can call themselves that) today are taught a language like VB, Cold Fusion, or whatever. Languages have become so advanced that one thinks they are meant to do everything when in fact they should simply make our job a bit easier. Objects within the lanugage are created so that we can access the database faster and easier (e.g. connection or recordset objects). Isn't the language really supposed to act as an interface between the data and the UI or end user? Maybe this is oversimplifying things a bit, but the fact that there are people out there who believe using paramaterized queries is the same as using a stored procedure just infuriates me. GET A CLUE! It doesn't matter if it's Cold Fusion, VB, .NET, Java, whatever. Learn the basic principals and fundamentals and then choose a language that works for you.

SERENITY NOW!

2006-08-22 Reply Admin

Anonymous:
can you guys PLEASE find something more interesting to talk about than development platform wars.. it's so tired!

Exactly, no one platform is the most elegant in all situations.

DZ-Jay · 2006-08-22 Reply Admin

Anonymous:
DZ-Jay:

There are certainly other frameworks for developing web applications apart from ASP or PHP, and some of them focus on RAD, some of them even better, faster, and more robust and secure than your precious ColdFusion. But I most definitely wouldn't call ColdFusion a "Real Programming Language".

-dZ.

Name one.

And I didn't say it's a real programming language. I said it's a "Real Web Programming Language". It has not much use outside the web world, but in the web world it's one of the most robust, RAD platforms out there. Seriously. I dare you. Name one other programming language that even comes close to CF in terms of RAD.

Ruby and just about any other thing on Rails.

dZ.

2006-08-22 Reply Admin

Anonymous:
Anonymous:

Ah, another useless CF coder.

CF does *not* automatically prevent of SQL injection.

Doing this in CF is just as bad as the example quoted:

<cfquery>

select *

from table

where id = #id#

</cfquery>

The way to prevent SQL injection in CF is to use the <cfqueryparam> tag.

<cfquery>

select *

from table

where id = <cfqueryparam value="#id#">

</cfquery>

Gawd, why the hell are all CF users so damned smug and yet so dumb?

I never said that it automatically prevents SQL injection, but it does automatically escape single quotes.

Although your example is one of the right ways to prevent sql injection, there are many more.

<cfargument name="id" type="numeric">

and
<cfquery>

select *

from table

where id = #val(id)#

</cfquery>

are 2 other ways, and neither of them prevents you from caching the query.

So stop shooting off your mouth when you don't know any better.

Spare me your pedantic shit. I've used CF since 1997, so I'm far more of a veteran of that POS platform than you assume.

Yeah, the val function sure works well for strings and dates.

And <cfargument> is used only within <cffunction>, what the fuck does it have to do with SQL injection? I suggest you "stop shooting off your mouth when you don't know any better.", loser.

DZ-Jay · 2006-08-22 Reply Admin

GoatCheez:
Anonymous:
can you guys PLEASE find something more interesting to talk about than development platform wars.. it's so tired!

No, YOU'RE A TOWEL!!!

I'M NOT SHOELESS! YOU'RE SHOELESS!!!

-dZ.

DZ-Jay · 2006-08-22 Reply Admin

mhughes:
Anonymous:

Name one.

And I didn't say it's a real programming language. I said it's a "Real Web Programming Language". It has not much use outside the web world, but in the web world it's one of the most robust, RAD platforms out there. Seriously. I dare you. Name one other programming language that even comes close to CF in terms of RAD.

I haven't used CF in a long time... is the following still true?

Cold Fusion is to (Ruby On Rails | PHP | JSP) what Visual Basic is to (C++ | C# | Java)

Pretty much.

2006-08-22 Reply Admin

I was a jsp/servlet programmer, I changed jobs and was forced to use ColdFusion and hated it (luckily I'm back to servlets/portlets). It did allow developers to create apps quickly but it led to badly designed apps. Basically, I would describe CF as a set of jsp tags in a fancy editor. Now that JSTL (and many other tag libs) exists and the java editors can use them effectively, I don't see any advantages of CF. The makers have done a lot of work to integrate it with other languages/platforms etc but this just convinces me that they don't see any value in their product either.

JSP I believe is more efficient then coldfusion, but a lot harder to code in. Basically you are trading execution speed for development time. And with the speed of the servers on the market today, do you really want to do that?
If used incorrectly, any language/platform will be slow, regardless of server.

ColdFusion runs on top of J2EE sort of like JSP. It also allows you to call java classes nativelly. So basically it's JSP that's a little slower, but lets you develop applications a lot faster.
Huh, why is JSP slower? They get compiled into servlet classes. I'm fairly certain CF gets compiled into classes as well. Yes, I agree that you can generally develop applications faster using CF but only because of the editor. If you take a CF programmer and a jsp programmer and just give them text editors, I suspect the jsp programmer will create a better app in less time (just because they are better programmers and understand dev principles better).

My 2 cents, based upon many years exp in both.

PS, when I refer to jsp apps, I assume they are actually true MVC apps that use servlets, jsps, tag libs etc..

Jeff S · 2006-08-22 Reply Admin

Bus Raker:
Anonymous:
Bus Raker:
richleick:
Alex Papadimoulis:
When developing an application that uses in-line SQL queries, it's essential to protect against "SQL Injection", i.e. the insertion of SQL code as a result of a string concatenation. For example, if productNum comes directly from user input, it might contain a malicious string, such as "'; DROP DATABASE --"
myQuery = "SELECT Prod_Name FROM Products WHERE Prod_Num='" + productNum "';";
The best way to do this is through "parameterized queries," which lets the database libraries take care of it. The next best way is to write your own escaping functions. And the next best way is to replace all instances of "O'Reily" with "O''Reily".
Close. Add the use of stored procedures and I'm all for it. Oh wait, that would mean if you are using an earlier version of MySQL you probably never heard of these.
Uh ... I think parameterized queries = stored procedures. Is there another kind I don't know about?
uh?...

parameterized queries != stored procedures
Sorry ... I'm only a product of my experience, which has been that all database involvement through an application happens via stored procedures. How else can you control security at the action level?

I apologize in advance for the shameless plug, but you might want to read this:

http://weblogs.sqlteam.com/jeffs/archive/2006/07/21/10728.aspx

Please note that the point of the article is *not* to avoid stored procedures, but rather how to correctly use parameters to not only avoid sql injection but to avoid other issues that arise when you concatenate SQL statements and input all into 1 big string to execute.

Stored procs, IMHO, are the way to go, but even if you don't use them, you should never need to escape any user input when using a database library that supports parameterized queries.

2006-08-22 Reply Admin

John Bigboote:
Anonymous:

To wrap it up, if you need to find out which queries access a specific table (because you're about to add a required column, or whatever reason) you just need to grep the directory(ies) that contain the stored procedure scripts. You can also have multiple applications that use the same stored procedures, and for some reason it's not practical for these apps to use the same data access layer.

Or, if you're using SQL Server, you can use sp_depends, which will tell you about ALL procs hitting a particular table regardless of where their create scripts are.

sp_depends is OK for a quick glimpse but sysdepends can get out of sync. For example if your change management team deploys a proc before a table, they get a warning that the procedure is applied but sysdepends has not been updated.

2006-08-22 Reply Admin

I have no idea how you guys go from this to a giant discussion about SQL-injection attacks and the like, but really, the only impression that I get from this line of code is that whoever wrote it doens't bother to look at the bigger picture at times, and prefers to write a quick work-around, rather than an all encompassing solution, resulting in a lot of single use code that could be shrunk down to a couple well-writen methods.

2006-08-22 Reply Admin

Irrelevant:
Anonymous:
Anonymous:
Name one... Seriously. I dare you.
Ruby.
Excuse me sir, the maitre d' sent me over... he asked me to pass on this message... *ahem*

YOU GOT SERVED!

...to be serious for a moment, I think the mistake was in saying "real web programming language" at all. IMO, ColdFusion looks more like a "templating language". It's advanced as those go, yes, but you can't expect calling an XML-based language a "programming language" to be taken seriously.

It's not an XML-based language. I don't think you know what you're talking about either, so don't even bother.

ColdFusion is an impertive programming language that just has a weird syntax. It also has some declarative elements to it, but for the most part you code impertively.

The main problem I find with it is that it's bloody expensive, it's buggy as hell, it's a massive resource hog, and it ain't "robust" in any sense of the word.

It's main failing is that it's one of those 80/20 solutions. It does 80% of what you need, and the other 20% is going to kill you.

Take threading. There's no way for you manage threads. Sure, most of the time you don't need threads. But when you do, there's absolutely no way for you extend the language for you to use threads without jumping to Java. Which totally defeats using the RAD language in the first place.

2006-08-22 Reply Admin

Anonymous:
Anonymous:
Anonymous:

Ah, another useless CF coder.

CF does *not* automatically prevent of SQL injection.

Doing this in CF is just as bad as the example quoted:

<cfquery>

select *

from table

where id = #id#

</cfquery>

The way to prevent SQL injection in CF is to use the <cfqueryparam> tag.

<cfquery>

select *

from table

where id = <cfqueryparam value="#id#">

</cfquery>

Gawd, why the hell are all CF users so damned smug and yet so dumb?

I never said that it automatically prevents SQL injection, but it does automatically escape single quotes.

Although your example is one of the right ways to prevent sql injection, there are many more.

<cfargument name="id" type="numeric">

and
<cfquery>

select *

from table

where id = #val(id)#

</cfquery>

are 2 other ways, and neither of them prevents you from caching the query.

So stop shooting off your mouth when you don't know any better.
Spare me your pedantic shit. I've used CF since 1997, so I'm far more of a veteran of that POS platform than you assume.

Yeah, the val function sure works well for strings and dates.

And <cfargument> is used only within <cffunction>, what the fuck does it have to do with SQL injection? I suggest you "stop shooting off your mouth when you don't know any better.", loser.

In our environment all the queries are inside cffunctions as we separate the data layer, and therefore it's a working alternative to cfqueryparam.

Val works for numbers. For strings you would use single quotes inside the cfquery, and all other single quotes are automatically escaped. I dare you to show me a piece of code that does sql injection using strings.

We don't use dates, so I'm not sure whether or not that needs to be cfqueryparam'ed.

So stop with the name calling, crawl out from your parents' basement, and get a life.

2006-08-22 Reply Admin

Anonymous:
Irrelevant:
Anonymous:
Anonymous:
Name one... Seriously. I dare you.
Ruby.
Excuse me sir, the maitre d' sent me over... he asked me to pass on this message... *ahem*

YOU GOT SERVED!

...to be serious for a moment, I think the mistake was in saying "real web programming language" at all. IMO, ColdFusion looks more like a "templating language". It's advanced as those go, yes, but you can't expect calling an XML-based language a "programming language" to be taken seriously.
It's not an XML-based language. I don't think you know what you're talking about either, so don't even bother.

ColdFusion is an impertive programming language that just has a weird syntax. It also has some declarative elements to it, but for the most part you code impertively.

The main problem I find with it is that it's bloody expensive, it's buggy as hell, it's a massive resource hog, and it ain't "robust" in any sense of the word.

It's main failing is that it's one of those 80/20 solutions. It does 80% of what you need, and the other 20% is going to kill you.

Take threading. There's no way for you manage threads. Sure, most of the time you don't need threads. But when you do, there's absolutely no way for you extend the language for you to use threads without jumping to Java. Which totally defeats using the RAD language in the first place.

The whole point is that it lets you do the 80% of stuff you need very easily. For the other 20%, you can jump to java (or get someone else's extension written in java or c++).

And I do believe there is a way to manage threads now using event gateways, but I haven't played around with it yet.

2006-08-22 Reply Admin

Don't know if I would call ColdFusion a "real web programming language", maybe a "real scripting language" (kind of like ASP was a "real useful language").

The best way of doing it (if you are going to ignore parameterised queries and escaping) is to run all the queries via an account that has minimum necessary priveleges (i.e. SELECT on only the necessary tables), but the best defence is defense in depth so applying all of the approaches mentioned is really the only true "best way".

=)

GrandmasterB · 2006-08-22 Reply Admin

Sean:
Anonymous:
Simple, ban the Irish and the Scots.

And the Vulcans.

And the Jaffa. In fact, most extra-terrestrials wont be able to use that system.

biziclop · 2006-08-22 Reply Admin

It's about time to create a new mascot for kids: SQL Injection Panda.

GrandmasterB · 2006-08-22 Reply Admin

Anonymous:
Name one other programming language that even comes close to CF in terms of RAD.

ASP & PHP

I can develop apps 20 times faster in either than in Cold Fusion

'Course, I've never used Cold Fusion. Nor do I give a rats ass if something is buzzword-compliant ('RAD') or not.

2006-08-22 Reply Admin

Anonymous:
Anonymous:

Such as? I can write any stored procedure inside a CF query, and it will probably run in about the same time if I use parameters to call it. Other then speed, what other benefits are there?

If you're using SQL Server, the difference in execution time is true for older versions (pre-7.0 I believe). In current versions the execution plan is cached for ad-hoc queries, almost eliminating the difference in execution time.

If you're performing a "bulk insert" without using the bulk insert command (most DBA's will disable this because it places a lock on the entire table) by repeatedly calling INSERT, it would be more efficient to pass the entire SQL text than to iteratively call a stored procedure.

To me, the benefit comes in having all direct table access logic separated from the code. If something needs to be changed in a SQL script, only the stored procedure needs to be deployed. Also, if you're lucky enough to have no exceptions that require straight SQL, you can grant users only execute permissions to the stored procedures, so there's no ad-hoc queries that lock important tables or perform data manipulation that you haven't explicitly allowed. In a word, abstraction.

To wrap it up, if you need to find out which queries access a specific table (because you're about to add a required column, or whatever reason) you just need to grep the directory(ies) that contain the stored procedure scripts. You can also have multiple applications that use the same stored procedures, and for some reason it's not practical for these apps to use the same data access layer.

I don't know how you keep your stored procs in directorys (maybe on mysql), but we use sql server, and it's hell managing stored procs. That's why we put everything in CFC's now (ColdFusion Components, basically classes), and all the db access happens through there. If I need to see what method accesses a certain table, I can just do a search from eclipse, and can even do a replace all in one place. And the code gets put into subversion and gets deployed when it needs to get deployed.

Stored procs are a pain. If there was an easy way to have them in source control, maybe I'd use them more, but in a web environment, where you don't necessarily care about fine grained permissions to stored procs, I much prefer to have them in my code (in a separate data layer of course).

Bus Raker · 2006-08-22 Reply Admin

richleick:
but the fact that there are people out there who believe using paramaterized queries is the same as using a stored procedure just infuriates me. GET A CLUE!

In my databases there are no such things as parameterized queries (BTW not paramaterized) . If a front-end developer wants to use them they will have to find a new gig. Might as well give them a license to run dynamic SQL...

ha ha ha

BTW I also pronounce them DAAT - A - BASES not DAHT-A-BASES.

Take that! You should really take a valium rather then let a post bother you so much. You also probably yell at traffic.

PaulTomblin · 2006-08-22 Reply Admin

merreborn:

"Currently, a valid SSN cannot have the first three digits (the area number) above 772, the highest area number which the Social Security Administration has allocated."

http://en.wikipedia.org/wiki/Social_Security_number_%28United_States%29#Valid_SSNs

Either wikipedia's dead wrong, or someone was feeding your system invalid SSNs

Wikipedia wrong? Somebody stop the presses!

I had to get taxpayer identification numbers for my kids. Taxpayer identification number are like social security numbers for non-residents who have to pay taxes or be declared as dependants by other tax payers, and they are designed to be entered into forms that require a SSN, and follow the same numbering conventions. My daughters' TINs started in the 970s.

GoatCheez · 2006-08-22 Reply Admin

Anonymous:
DZ-Jay:

There are certainly other frameworks for developing web applications apart from ASP or PHP, and some of them focus on RAD, some of them even better, faster, and more robust and secure than your precious ColdFusion. But I most definitely wouldn't call ColdFusion a "Real Programming Language".

-dZ.

Name one.

And I didn't say it's a real programming language. I said it's a "Real Web Programming Language". It has not much use outside the web world, but in the web world it's one of the most robust, RAD platforms out there. Seriously. I dare you. Name one other programming language that even comes close to CF in terms of RAD.

Ruby on Rails is 3 degrees RADer than CF, and even ASP.NET is RADer by a factor of two. I think you need to learn how to quantify RADness first, then you can make statements on how RAD something is. Do a google on RAD quantifying techniques for programming languages, you'll find the current preferred method is the "Web2.0ifizationer" as opposed to the now old "ScriptKiddie1337nessFinder".

Oh... wait... you meant rapid application development, not "cool" nifty trend.... my bad lol

GrandmasterB · 2006-08-22 Reply Admin

Anonymous:

Personally, I haven't looked into Ruby yet,

I've looked in to it. eh, nothing special that cant be done in any other language. I really dont get the over-zealousness of it's deciples one the net. It's practically cult-like.

mattwho · 2006-08-22 Reply Admin

Those number's aren't SSN's but are Temporary ID numbers assigned by DoD and not by SSA.

merreborn · 2006-08-22 Reply Admin

Saarus:

The use of 800-series SSNs is not restricted to illegal immigrants.

When I was in the USAF I worked medical records, which are filed by SSN. On base would be foreign military members and family members, on exchange for training or layover, who had no SSNs. SSN is required for medical treatment in a military medical facility. For all such foreign nationals, they are assigned a SSN which starts with 800. the rest is determined by DOB. If two or more such people have the same DOB, the first three digits are incremented.

Were people actually issued those SSNs? Or is this just an internal policy for dealing with record keeping?

Just 'cause you refered to these people by numbers that were in an SSN format at work, doesn't mean that those people were actually issued those SSNs. So said 800 SSNs still wouldn't qualify as valid.

mattwho:
Those number's aren't SSN's but are Temporary ID numbers assigned by DoD and not by SSA.

Looks like mattwho just confirmed my suspicions

2006-08-22 Reply Admin

Anonymous:

I don't know how you keep your stored procs in directorys (maybe on mysql), but we use sql server, and it's hell managing stored procs. That's why we put everything in CFC's now (ColdFusion Components, basically classes), and all the db access happens through there. If I need to see what method accesses a certain table, I can just do a search from eclipse, and can even do a replace all in one place. And the code gets put into subversion and gets deployed when it needs to get deployed.

Stored procs are a pain. If there was an easy way to have them in source control, maybe I'd use them more, but in a web environment, where you don't necessarily care about fine grained permissions to stored procs, I much prefer to have them in my code (in a separate data layer of course).

We keep the scripts in VSS (soon Telelogic) and check them out to a local working directory. Open the script in query analyzer, make the edits, apply, until you're satisfied. Then check it back in, capture the version # of the script, and send that info off in the deployment instructions.

2006-08-22 Reply Admin

"Currently, a valid SSN cannot have the first three digits (the area number) above 772, the highest area number which the Social Security Administration has allocated."

"Either wikipedia's dead wrong, or someone was feeding your system invalid SSNs"

				    <br>Actually, for university purposes, sometimes foreign students get 'pretend' ssn's much higer than that.&nbsp; It's a widely known problem that ssn's aren't unique nor well-ranged.<br><br>CAPTCHA:&nbsp; mustache???<br>

2006-08-22 Reply Admin

This comment is majorly off topic, but this reminds me of HaXml, which is an XML processing library for Haskell. You can use it to transform XML, as in XSLT, only you're not limited by the fake languageness of XSLT. Anyways, the basic idea behind HaXml is that you use filters, which are functions mapping an XML node to other XML nodes, and combinators, which combine these filters in various ways. One of these combinators composes two filters, feeding the results of one filter into another filter. Because filters take a single node as input and return a lit of nodes, the standard Haskell composition operator doesn't suffice. Instead, you need an operator that calls the second filter on each of the results of the first filter. Borrowing from the mathematical composition notation, which is a little circle, the HaXml people decided to use the o for an operator. To use a function as an infix operator in Haskell, you surround it by backquotes (take that, lisp!). Thus

filter1 o filter2 o filter3

It's called "Irish composition".

Strydyr · 2006-08-22 Reply Admin

Anonymous:

Actually the best way of doing it is to use a real web programming language like ColdFusion, which will do all the escaping for you.

Thank you! I know other people have picked up the ball on this; but, it's really the best laugh I've gotten out of the forum in a week. Too bad I had a mouth full of coffee.

The best part is where you go from calling it a "real web programming language" directly into explaining how it shields the developer from actually having to understand development.

Brilliant!

John Bigboote · 2006-08-22 Reply Admin

GoatCheez:

Ruby on Rails is 3 degrees RADer than CF, and even ASP.NET is RADer by a factor of two. I think you need to learn how to quantify RADness first, then you can make statements on how RAD something is.

I'm so beyond RAD it's ridiculous. I now evaluate development platforms in terms of COOL (Compliance with Object-Oriented Languages) and DOPE (Design-Oriented Platform Extensions)

2006-08-22 Reply Admin

Since when do stored procedures prevent SQL injection attacks?

You still have to properly escape or parameterize your queries. Whether they call a stored procedure or not is 100% immaterial.

I dance the captcha (foxtrot).

rev · 2006-08-22 Reply Admin

Anonymous:
Anonymous:
Ah, another useless CF coder.

CF does *not* automatically prevent of SQL injection.

Doing this in CF is just as bad as the example quoted:

<cfquery>

select *

from table

where id = #id#

</cfquery>

The way to prevent SQL injection in CF is to use the <cfqueryparam> tag.

<cfquery>

select *

from table

where id = <cfqueryparam value="#id#">

</cfquery>

Gawd, why the hell are all CF users so damned smug and yet so dumb?

I never said that it automatically prevents SQL injection, but it does automatically escape single quotes.

Although your example is one of the right ways to prevent sql injection, there are many more.

<cfargument name="id" type="numeric">

and
<cfquery>

select *

from table

where id = #val(id)#

</cfquery>

are 2 other ways, and neither of them prevents you from caching the query.

So stop shooting off your mouth when you don't know any better.

I think this was the biggest problem I found when tried programming in coldfusion (this was about 2.5 years ago). There are multiple ways to access the value of a variable, but certain ones are only available in certain contexts. Also, some of the methods seem grossly verbose.

Also, I found that there were several tags that served essentially the same purpose, but had different limitations to how they could be nested. Although it was all well documented, it was unintuitive and often seemed to lack any underlying logic.

2006-08-22 Reply Admin

hehe anonymous doesn't realize ColdFusion the web application shit is just as functional as the other ColdFusion

ColdFusion is a clusterfuck of shit with no redeeming value what-so-ever

if you want to use java server pages, use java server pages, not java-server-pages-lite (aka Coldfusion)

either way - JSP and CFM are 100% lossage

John Bigboote · 2006-08-22 Reply Admin

Anonymous:
Since when do stored procedures prevent SQL injection attacks?

You still have to properly escape or parameterize your queries. Whether they call a stored procedure or not is 100% immaterial.

Only if you are calling your procs by dynamically concatenating an EXEC string, which is a really bad idea.

2006-08-22 Reply Admin

Anonymous:

In our environment all the queries are inside cffunctions as we separate the data layer, and therefore it's a working alternative to cfqueryparam.

Val works for numbers. For strings you would use single quotes inside the cfquery, and all other single quotes are automatically escaped. I dare you to show me a piece of code that does sql injection using strings.

We don't use dates, so I'm not sure whether or not that needs to be cfqueryparam'ed.

So stop with the name calling, crawl out from your parents' basement, and get a life.

I know many instances of SQL injections via strings *cough*lazy PHP programmers who don't use mysql_escape_string*cough* - however I am not allowed to show you the code snippets

i'm an agressive sql-injection killer whenever I pickup maintainership of a php application.

btw you started out your entire "CFM IS GREAT!" with a lie about "cfm automatically.. blah blah" bullshit

escaping php values in php? two functions - mysql_escape_string() not binary safe, mysql_real_escape_string() binary safe

sounds like you have a lot of munging to do in CFM to figure out your context crap

CFM = slow, shitty, crap

themagni · 2006-08-22 Reply Admin

Saarus:
themagni:
merreborn:
Satanicpuppy:
Stupid. Where there is one special case there are a million, so, unless you want to fix them all by hand, it's time to re-imagine your logic.

I had the reverse problem once...I was working on a system where the system automatically threw out all SSNs that started with "800". I got egg on my face because I told the user that that was impossible (I hadn't written the application, and I "knew" the guy who had hadn't been a MORON), and when she
showed me that it was possible, I set forth on an quest to find the one line of code that declared all 800 ssns invalid.

Sigh.

"Currently, a valid SSN cannot have the first three digits (the area number) above 772, the highest area number which the Social Security Administration has allocated."

http://en.wikipedia.org/wiki/Social_Security_number_%28United_States%29#Valid_SSNs

Either wikipedia's dead wrong, or someone was feeding your system invalid SSNs

They're using the 800 series for Illegal Immigrants.

The use of 800-series SSNs is not restricted to illegal immigrants.

When I was in the USAF I worked medical records, which are filed by SSN. On base would be foreign military members and family members, on exchange for training or layover, who had no SSNs. SSN is required for medical treatment in a military medical facility. For all such foreign nationals, they are assigned a SSN which starts with 800. the rest is determined by DOB. If two or more such people have the same DOB, the first three digits are incremented.

Huh. I thought I was making a joke. I'm not from the US, so I don't see a lot of SSN. Come to think of it, I think that the Woolworth's example is the only one I've seen.

maldrich · 2006-08-22 Reply Admin

Anonymous:

Actually the best way of doing it is to use a real web programming language like ColdFusion, which will do all the escaping for you. The best, best way is to do it in coldfusion with parametarized queries, but even if the coder is not smart enough to use them, this kind of issue just wouldn't even come up.

OK, I can't decide what's funnier: the fact that ColdFusion has the name of one of the biggest scientific hoaxes ever, and the name never changed, or the fact that someone's trying to argue its merits on a site like this. And I write using ColdFusion (and other things -- that's key. Usually zealotry comes in proportion to how narrow a person's experience is). Thanks for the laugh!

2006-08-22 Reply Admin

I don't know how you keep your stored procs in directorys (maybe on mysql), but we use sql server, and it's hell managing stored procs. That's why we put everything in CFC's now (ColdFusion Components, basically classes), and all the db access happens through there. If I need to see what method accesses a certain table, I can just do a search from eclipse, and can even do a replace all in one place. And the code gets put into subversion and gets deployed when it needs to get deployed.

Stored procs are a pain. If there was an easy way to have them in source control, maybe I'd use them more, but in a web environment, where you don't necessarily care about fine grained permissions to stored procs, I much prefer to have them in my code (in a separate data layer of course).

I don't understand why you couldn't use stored procedures & source control, I did this for many years using SQL Server & CVS. Stored procedures can be written as plain text files and "installed" easily by running the text file in query analyzer, enterprise administrator or the command line tool since they use the create command (use a ifdefined / drop statemtent to del it first when necessary). I think if you export a stored procedure using enterprise manager, it adds all the drop/create commands for you. If you change the sp, you have to re-install it again but this is no different than changing a query in CF and re-installing the cf page.

There's many pros/cons about stored procedures but having them in source control should not be an issue at all.

merreborn · 2006-08-22 Reply Admin

http://www.eff.org/Privacy/ID_SSN_fingerprinting/ssn_structure.article

Another article stating SSNs starting with 800 are fake. I don't doubt that many organizations use these to identify those without SSNs, but that doesn't make them valid.

If you have to feed your software SSNs for every customer, your software is flawed.

2006-08-22 Reply Admin

GrandmasterB:
Anonymous:
Name one other programming language that even comes close to CF in terms of RAD.

ASP & PHP

I can develop apps 20 times faster in either than in Cold Fusion

'Course, I've never used Cold Fusion. Nor do I give a rats ass if something is buzzword-compliant ('RAD') or not.

Lets see... How about a small example. Get a list of users from the database and output firstname, lastname and username. Here is the code in CF
<cfquery name="qryUsers" datasource="#request.mydsn#">
select firstname, lastname, username from users
</cfquery>
<cfoutput query="#qryUsers#">#firstName# #lastName# #userName# </cfoutput>

Now lets see how long and convoluted a similar example in php/asp is going to be.

merreborn · 2006-08-22 Reply Admin

Anonymous:
merreborn:

"Currently, a valid SSN cannot have the first three digits (the area number) above 772, the highest area number which the Social Security Administration has allocated."

http://en.wikipedia.org/wiki/Social_Security_number_%28United_States%29#Valid_SSNs

Either wikipedia's dead wrong, or someone was feeding your system invalid SSNs

"CURRENTLY" is the key word here. Do you want to have to change the code in the system when the SSA starts allocating numbers that start with 800? And, in the future, just how exactly are you to know that the SSA has started doing this? Are they going to publicly announce that they are now using numbers that start with 800 (or above 772?) And does the "currently" statement have a date on it? "Currently" could have been a couple of years ago (how old is Wikipedia, anyway?) and might not even now be valid.

You don't want to code something related to SSNs starting with 800 based on what the SSA "currently" does.

Good point! Why validate anything? Just 'cause the big 4 major credit card companies use the "Mod 10" hashing algorithm doesn't mean you shouldn't accept cards that don't pass the check!

Hell, they don't allow *letters* in SSN numbers yet, but they might someday, so let's let those in too! And maybe they'll add more digits later!

Don't validate data! It's more future proof!

In a well-written system, there's a single "ValidateSSN" function for this sort of thing. If anything changes, there's a single place to update the code.

2006-08-22 Reply Admin

Anonymous:

I don't know how you keep your stored procs in directorys (maybe on mysql), but we use sql server, and it's hell managing stored procs. That's why we put everything in CFC's now (ColdFusion Components, basically classes), and all the db access happens through there. If I need to see what method accesses a certain table, I can just do a search from eclipse, and can even do a replace all in one place. And the code gets put into subversion and gets deployed when it needs to get deployed.

Stored procs are a pain. If there was an easy way to have them in source control, maybe I'd use them more, but in a web environment, where you don't necessarily care about fine grained permissions to stored procs, I much prefer to have them in my code (in a separate data layer of course).

I don't understand why you couldn't use stored procedures & source control, I did this for many years using SQL Server & CVS. Stored procedures can be written as plain text files and "installed" easily by running the text file in query analyzer, enterprise administrator or the command line tool since they use the create command (use a ifdefined / drop statemtent to del it first when necessary). I think if you export a stored procedure using enterprise manager, it adds all the drop/create commands for you. If you change the sp, you have to re-install it again but this is no different than changing a query in CF and re-installing the cf page.

There's many pros/cons about stored procedures but having them in source control should not be an issue at all.

Drop/Create means you have to reapply permissions. If your DBA is an arrogant ass (a lot are) you might want to try this as a practical joke.

2006-08-22 Reply Admin

When I did a lot of web application work I always used apostrophe's in every text box I could. I still do test things this way - I guess old habit's die hard :-)

Poor Mr. O'Hare

Leave a comment on “Poor Mr. O'Hare ”