News for hackers. Stuff that matters.
Re:The Devil in Plain Text by lmm on Monday May 13, 2013 @09:40AM (#5698560)
Honestly this sort of thing is a much better fit for statically typed languages. In modern typed language like Haskell or Scala (and presumably also F#) it's very easy natural to build parsers that can move back and forth between string and text representations, and the APIs one uses are largely generic whether one is building XML, Javascript, SQL or something else. It's also natural to use "tagged" datatypes to statically enforce that user input is handled differently from internal strings (I understand perl has a "taint" module that does the same thing, but presumably it has to happen at runtime, and I'm not aware of similar functionality in Python or Ruby at all).

Try a statically typed language sometime - they're not all like Java. You might be surprised.

Re:The Devil in Plain Text by kamaal on Monday May 13, 2013 @10:36AM (#5698864)
>>Try a statically typed language sometime - they're not all like Java. You might be surprised.

This statement shows the kind of damage Java has done to the larger programming community.

Let me tell you the reason why people shudder to use to Java for things like text processing. To do as simple a task- to simply read from a file, do minimal processing(like extracting fields) and write to another, you have to deal with tens of api calls often with long names. Its extremely difficult if not impossible to remember each and every api call and the order they need to called in. So the net result is every time you need to do something, no matter how simple. You simply go to the internet, get a known-to-work-well template and just copy-paste it into your code.

And this is just the beginning, a sufficiently large Java application can be totally incomprehensible to understand, modify or develop without an IDE. Far too many nested api calls, far too much XML. Bulk of Java code today in the wild is machine generated and machine modified(I mean through IDE's)

Java these days feels like assembly language programming. You have to play with far too many api's to do even the simplest of the tasks.

No wonder people flock to a dynamic language at every chance they get.

Re:The Devil in Plain Text by waxjar on Monday May 13, 2013 @11:18AM (#5699125)
Ruby has a tainting mechanism, but I don't believe it's used very much.

http://www.ruby-doc.org/docs/ProgrammingRuby/html/taint.html

Re:The Devil in Plain Text by zokier on Monday May 13, 2013 @11:00AM (#5699018)
I've grown to hate the phrase "static typing". It's almost as meaningless as "strong typing". While checking types compile-time certainly has it's benefits, the issue presented here is almost entirely orthogonal to that. The problem here is that strings are handled essentially as untyped opaque blobs as far as the type system is concerned. If the strings were typed properly, then both static and dynamic type systems (if otherwise equivalent) would catch the errors.
Re:The Devil in Plain Text by fimad on Monday May 13, 2013 @07:30PM (#5702101)
The idea is that you wouldn't use the generic string type for everything. You'd use an SQL type for queries and a different type for user input and there would be methods to convert between the two. This ensures at compile time that all data is properly escaped because its a type error to mix a user input value with an SQL value.