News for hackers. Stuff that matters.
Re:The Devil in Plain Text by zokier on Monday May 13, 2013 @11:00AM (#5699018)
I've grown to hate the phrase "static typing". It's almost as meaningless as "strong typing". While checking types compile-time certainly has it's benefits, the issue presented here is almost entirely orthogonal to that. The problem here is that strings are handled essentially as untyped opaque blobs as far as the type system is concerned. If the strings were typed properly, then both static and dynamic type systems (if otherwise equivalent) would catch the errors.
Re:The Devil in Plain Text by fimad on Monday May 13, 2013 @07:30PM (#5702101)
The idea is that you wouldn't use the generic string type for everything. You'd use an SQL type for queries and a different type for user input and there would be methods to convert between the two. This ensures at compile time that all data is properly escaped because its a type error to mix a user input value with an SQL value.