We do not use foreign keys (2016)

Re:We do not use foreign keys (2016) by spookthesunset on Friday November 08, 2019 @05:57PM (#21487792)

Do you not check input from your javascript front-end before you save it? Even if that front-end does its own validation? (No, you see, but there is only one web front-end.... we don't need the backend to validate the input!!!!)

In what way is letting the database ensure it isn't getting fed crap any different?

Why do developers constantly think it is okay to let unvalidated user input hit their database? Any client calling your database is a hostile client that will feed your database bad data. Arguing otherwise is complete ignorance.

[ Parent | on HN ]

Re:We do not use foreign keys (2016) by Dylan16807 on Friday November 08, 2019 @06:33PM (#21488083)

> In what way is letting the database ensure it isn't getting fed crap any different?

Because one canonical validation layer is generally enough. You can see how having two separate partial validation layers could cause problems, right? And you can't put all the validation in the database, for non-trivial apps.

And "clients" shouldn't be talking to the database, no matter if you have foreign keys or not. That's a totally separate issue.

[ Parent | on HN ]