• @PriorProject
    link
    561 year ago

    I thought that was the first rule of rendering web content? Or was it protocol parsers?

    I remember, it was first rule of video game character creation screens:

    choose wisely: wisely

  • @galaxies_collide
    link
    291 year ago

    Second rule of SQL: Never trust user input. Third rule of SQL: Never trust user input.

  • TheSaneWriter
    link
    fedilink
    241 year ago

    Honestly, this is a good rule for programming in general. With user input, make sure it’s in its own area where it can’t interact with anything else and make sure to read and process in such a way that it can’t fuck with the operation of the program.

    • @[email protected]
      link
      fedilink
      41 year ago

      It should be the first rule of building any formatted string. I see code daily building HTML, JSON, CSS, CSV, shell scripts or whatever just by bashing strings together. If you are lucky they do some form of escaping most of the time.

      Really we should get in the habit of using proper encoders. Don’t think of these types as just strings you can substitute into, use some library that will actually write these things properly. Thankfully JS has JSON.stringify and good object literals so at least you don’t see shitty JSON encoding often (just sometimes when embedded in HTML). I wonder if adding string interpolation was a mistake. It makes it so easy to do the wrong thing. Of course there are cases where you want to format `Hello ${user.name}` or other human readable strings. But more often than not I see it being used incorrectly.

  • @CIA_chatbot
    link
    161 year ago

    Ahh yes, the little Bobby tables rule