Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
McGlockenshire
Dec 16, 2005

GOLLOCKS!

Jonnty posted:

Does that imply that there are programs that somehow rely on the buggy behaviour of that escape function, then?
Not the buggy behavior, but the fact that it exists and "works."

mysql_real_escape_string requires an active connection to MySQL. The potentially broken non-real one does not. This is a problem to some programs that were designed by newbies/idiots/idiot newbies.

Again, though, real programmers use prepared statements / parameterized queries. This of course explains why everyone learning PHP does so from a ten year old guide that treats 5.0 as scary and new and uses mysql_ by default.

Also,

quote:

If there's no sales tax then sweet! none will be added. However now our application is relying on undefined variables being permitted.
Then your application is broken. Turn error reporting all the way up, I'll bet you have three pages full of undefined variable and missing array key notices before any real output. isset and array_key_exists are your friends. Your best friends ever.

Worse, your application may well be designed for PHP4 and register_globals.

McGlockenshire fucked around with this message at 05:57 on Jun 11, 2010

Adbot
ADBOT LOVES YOU

Standish
May 21, 2001

Bhaal posted:

So imagine a block of 8 similar lines of code, with one of the variables on one of the lines having a slight typo. Now imagine that adding in possibly undefined values is par for the course throughout the app, so error handling is set up to ignore that (and good luck lobbying to get that changed).
If you're writing Perl you enable "use strict". If you're writing VB you use "Option Explicit". If you're writing C++ you use "-Wall". If you're writing PHP you use set_error_handler() set to output E_STRICT and E_NOTICE to a logfile/email.

Yes it requires a bunch of messing around to do something that really should be turned on by default in the first place, but that's PHP for you.

quote:

When I found the bug all I could think of is how dumb does your language have to be (and the people who adopt lovely paradigms with it) to let something as simple as a mistyped variable cause so much grief. Whereas in java or C++ or whatever, somewhere months and months into the pre-testing era a programmer would've hit compile, the compiler would've said "Hey jackass, wtf is $donkyballs?", and 5 seconds later it would've been a thing of the past.
No because in C++ the same people who won't let you enable PHP warnings for undefined variables wouldn't let you turn on "-Wformat" so you'd make a typo "%n" where it should be "%d", have fun tracking that one down.

Modern Pragmatist
Aug 20, 2008
Found this minor one today:
code:
if (1 != phase) {
    phase = 1;
}
The worse part being that in some instances, phase was not defined before this statement.

POKEMAN SAM
Jul 8, 2004

Modern Pragmatist posted:

code:
if (1 != phase) {

Man I hate that backwards rear end poo poo.

Flobbster
Feb 17, 2005

"Cadet Kirk, after the way you cheated on the Kobayashi Maru test I oughta punch you in tha face!"

Ugg boots posted:

Man I hate that backwards rear end poo poo.

The only time I ever do something like this is when I'm in Java and I want to compare strings. Saying "foo".equals(str) instead of str.equals("foo") makes things a little more concise in the even that str could be null.

Bhaal
Jul 13, 2001
I ain't going down alone
Dr. Infant, MD

Standish posted:

Yes it requires a bunch of messing around to do something that really should be turned on by default in the first place, but that's PHP for you.
Amen. I think what exacerbates things is that because it's out of the box behavior, you get a lot of stuff written that relies on the out of the box behavior. That's my problem, everything we do here with php is always within some large framework where fixing those problems would require redesigns & rewrites so large that it'll never happen in a million years.

quote:

No because in C++ the same people who won't let you enable PHP warnings for undefined variables wouldn't let you turn on "-Wformat" so you'd make a typo "%n" where it should be "%d", have fun tracking that one down.
Hah, definitely. A few years ago in fact I was at a place developing in C++ and it was exactly that. The lead programmer had carefully crafted makefiles that would step around all the warnings the compiler wanted to spit out from his questionable coding practices, and so the app would build without a peep out of gcc. I guess with PHP it feels like they make crap like that so accessible it's practically in the manual.

Bhaal fucked around with this message at 19:07 on Jun 11, 2010

POKEMAN SAM
Jul 8, 2004

Flobbster posted:

The only time I ever do something like this is when I'm in Java and I want to compare strings. Saying "foo".equals(str) instead of str.equals("foo") makes things a little more concise in the even that str could be null.

Yeah, in that case you're just avoiding the horror that is Java string comparison.

The Fro
Feb 25, 2006
Not really a horror, but the return at the end made me laugh.

code:
            if(total < 1000)
            {
                return total.ToString();
            }
            if(total < 10000 && total > 999)
            {
                decimal displayTotal = total / 1000;
                return string.Format("{0}k", displayTotal.ToString("#.#"));
            }
            if (total < 1000000 && total > 9999)
            {
                decimal displayTotal = total / 1000;
                return string.Format("{0}k", displayTotal.ToString("###"));
            }
            if (total < 1000000000 && total > 999999)
            {
                decimal displayTotal = total / 1000000;
                return string.Format("{0}MM", displayTotal.ToString("###"));
            }            

            return "wow";

Dessert Rose
May 17, 2004

awoken in control of a lucid deep dream...
The horror is the && total > 999... lines - not only would it just be better to use else if, you don't even need to because the if statements return.

I would love to see "Credits: wow" though.

OddObserver
Apr 3, 2009
Alternatively, I feel like it would be a whole lot more readable with conditionals like:

if (total >= 1000 && total < 10000)

if (total >= 10000 && total < 1000000)

etc.

Parantumaton
Jan 29, 2009


The OnLy ThInG
i LoVe MoRe
ThAn ChUgGiNg SeMeN
iS gEtTiNg PaId To Be A
sOcIaL MeDiA sHiLl
FoR mIcRoSoFt
AnD nOkIa

Ugg boots posted:

Yeah, in that case you're just avoiding the horror that is Java string comparison.

It's only horror if you consider the equals() general contract to be false (which doesn't make it any less annoying).

zergstain
Dec 15, 2005

I remember at my last job they used mysql_escape_string, since they didn't always have a connection when building queries. I guess the intention was to reduce load on the server, but I really have no idea. Or it was just poor design that would cost too much in developer time to fix. How much could doing it this way help to reduce load, anyway?

Dessert Rose
May 17, 2004

awoken in control of a lucid deep dream...

zergstain posted:

I remember at my last job they used mysql_escape_string, since they didn't always have a connection when building queries. I guess the intention was to reduce load on the server, but I really have no idea. Or it was just poor design that would cost too much in developer time to fix. How much could doing it this way help to reduce load, anyway?

Even if somehow it magically caused queries to always take no time at all it would still be a horrifyingly terrible idea to use it because it is completely insecure.

b0lt
Apr 29, 2005

Ryouga Inverse posted:

Even if somehow it magically caused queries to always take no time at all it would still be a horrifyingly terrible idea to use it because it is completely insecure.

Prepared statements are faster than building queries from strings anyway.

zergstain
Dec 15, 2005

Ryouga Inverse posted:

Even if somehow it magically caused queries to always take no time at all it would still be a horrifyingly terrible idea to use it because it is completely insecure.

Well of course it won't speed up queries, I was just wondering if it somehow helps to connect run the queries and immediately disconnect. Like maybe to reduce the chances of the server throwing a 'too many connections' error. But aren't persistent connections the answer for this?

As for security, I understand it's fine as long as you don't use multibyte strings.

b0lt posted:

Prepared statements are faster than building queries from strings anyway.

I don't even remember if we were on 5 when I worked there. I'm sure the code dates back before mysql 5.0, and again, cost of programmer time. In an ideal world it would be fixed.

HFX
Nov 29, 2004

b0lt posted:

Prepared statements are faster than building queries from strings anyway.

Provided your DBM is caching them properly. I had a Oracle DBM which reported that it was parsing the prepared statement every time I executed one. I only built the statement once and then used it over and over unless we lost database connectivity or there was a reason to close it. I worked with the DBA trying to figure out why it wasn't parsing for a couple days and we never could figure it out.

Edit: Since the code was no longer bottlenecking on the database code after me implementing the reuse connection and all statements, I sort of gave up on it and went after other bottlenecks.

HFX fucked around with this message at 00:21 on Jun 12, 2010

PraxxisParadoX
Jan 24, 2004
bittah.com
Pillbug

b0lt posted:

Prepared statements are faster than building queries from strings anyway.

Is there something around that proves this? I'm curious, because I think that, in PHP at least, a prepared statement requires two trips to the MySQL server: one to prepare the statement and one to execute it. Which is fine if you're using a query in a loop with lots of varying parameters, but seems like overkill when you do lots of one off queries.

Habnabit
Dec 30, 2007

lift your skinny fists like
antennas in germany.

b0lt posted:

Prepared statements are faster than building queries from strings anyway.

Fun fact: the author of the python-mysql library absolutely refuses to use parameterization in his binding because he insists that building queries from strings is always faster.

(One of these days I'll finish/publish my benchmarks showing oursql blowing mysqldb away. :v:)

king_kilr
May 25, 2007
MySQL is a coding horror. Is it possible to use a subquery yet ;)

TOO SCSI FOR MY CAT
Oct 12, 2008

this is what happens when you take UI design away from engineers and give it to a bunch of hipster art student "designers"

king_kilr posted:

MySQL is a coding horror. Is it possible to use a subquery yet ;)
Uh, yes? Subqueries were added over 6 years ago.

king_kilr
May 25, 2007

Janin posted:

Uh, yes? Subqueries were added over 6 years ago.

Oh sorry, I meant without using an on disk temporary table and killing all performance.

TOO SCSI FOR MY CAT
Oct 12, 2008

this is what happens when you take UI design away from engineers and give it to a bunch of hipster art student "designers"

king_kilr posted:

Oh sorry, I meant without using an on disk temporary table and killing all performance.
Subqueries are implemented by rewriting to joins; their use of memory or disk for temporary storage will be the same as using a join unless you totally gently caress-up the subquery or schema.

I prefer Postgres for reliability reasons, but it's not like the MySQL devs don't know how to optimize for performance.

UberJumper
May 20, 2007
woop
code:
def connectToFtp(ftp_connection_information_desc, ftp_connection_information):
	<do poo poo>
	return ("Connected to remote FTP via <stuff>", ftp_obj)
	
def listFiles(ftp_directory_desc, ftp_directory):
	<do poo poo>
	return ("Listed files at directory" + ftp_directory, <list of files>)
	
def DoLotsOfFTPShit():
	ftp = connectToFtp("Connecting to internal staging FTP Server", <insert connection information>)
	print ftp[0]
	ftp_obj = ftp[1]
	
	files = listFiles("List files in the ftp directory", <insert directory>)
	
	<do poo poo>


I looked around more and every single function this guy wrote follows this form:

code:
def <function name>(<parameter_name>_description, <parameter_name>, <rinse / repeat>):
	<body function>
	return (<description of return value>, <return value>)
I honestly have heard of "verbose" code. But what the christ :psyduck:. I haven't the faintest loving idea what the gently caress he was attempting or trying to achieve here. 99% of the time the description value is not used at all.

I think a bottle of scotch in the morning is needed. Ugh.

Chairman Steve
Mar 9, 2007
Whiter than sour cream

Ugg boots posted:

Yeah, in that case you're just avoiding the horror that is Java string comparison.

Can you elaborate? I'm not trying to call you out on anything - I'm genuinely interested to hear how String.equals() breaks the equals() contract.

zeekner
Jul 14, 2007

Chairman Steve posted:

Can you elaborate? I'm not trying to call you out on anything - I'm genuinely interested to hear how String.equals() breaks the equals() contract.

I think he's referring to the problem with null strings in Java. If foostring is null, and you call foostring.equals("whatever"), then you get a null pointer exception. If you reverse that call, since "whatever" is guaranteed not to be null, you will never have that exception. It's due to java treating strings like objects, and building the equals() function into that object.

e: The horror is that java includes the equals function into the string object, where most other languages handle it in a separate function that can handle null cases better.

zeekner fucked around with this message at 16:35 on Jun 12, 2010

Mustach
Mar 2, 2003

In this long line, there's been some real strange genes. You've got 'em all, with some extras thrown in.
The horror is having every user-defined type be a reference type and having all reference variables be nullable.

Internet Janitor
May 17, 2008

"That isn't the appropriate trash receptacle."

Geekner posted:

e: The horror is that java includes the equals function into the string object, where most other languages handle it in a separate function that can handle null cases better.

At this point you're just saying "this is a horror because Java is not like some other languages".

HFX
Nov 29, 2004

Mustach posted:

The horror is having every user-defined type be a reference type and having all reference variables be nullable.

This isn't really a horror either, but I can see a certain elegance in your way of thinking. That is to always force a reference variable to be defined at time of declaration. A programmer could do this by declaring a subclass of String to use for such occurrences. You could even have it throw exceptions if need be for certain methods. You would then assign the value of say UndefinedString when you wanted null. I can just imagine the bitching now.

Flobbster posted:

The only time I ever do something like this is when I'm in Java and I want to compare strings. Saying "foo".equals(str) instead of str.equals("foo") makes things a little more concise in the even that str could be null.

I'd have no problems with this if you define "foo" in a constant and then use the constant to do the equals test. It doesn't read exactly right, but it will work.

HFX fucked around with this message at 19:29 on Jun 12, 2010

qntm
Jun 17, 2009
http://en.wikipedia.org/wiki/Python_%28programming_language%29

quote:

While many programming languages round the result of integer division towards zero, Python always rounds it down towards minus infinity; so that 7//3 is 2, but (−7)//3 is −3.

Python provides a round function for rounding floats to integers. Version 2.6.1 and lower use round-away-from-zero: round(0.5) is 1.0, round(-0.5) is -1.0. Version 3.0 and higher use round-to-even: round(1.5) is 2.0, round(2.5) is 2.0.

??!

A A 2 3 5 8 K
Nov 24, 2003
Illiteracy... what does that word even mean?

qntm posted:

??!

Not sure what you're ??! about, but the bolded part is so that when rounding a large set of numbers, some will round down and some will round up, evening out, avoiding a bias of rounding all up or all down.

1337JiveTurkey
Feb 17, 2005

Somewhat more questionable is that Excel rounds up, VBA for Excel rounds to even and some contractors we hired didn't quite get that distinction.

FrantzX
Jan 28, 2007

qntm posted:

http://en.wikipedia.org/wiki/Python_%28programming_language%29

While many programming languages round the result of integer division towards zero, Python always rounds it down towards minus infinity; so that 7//3 is 2, but (−7)//3 is −3.

Python provides a round function for rounding floats to integers. Version 2.6.1 and lower use round-away-from-zero: round(0.5) is 1.0, round(-0.5) is -1.0. Version 3.0 and higher use round-to-even: round(1.5) is 2.0, round(2.5) is 2.0.

??!

http://en.wikipedia.org/wiki/Rounding#Round_half_to_even

Shumagorath
Jun 6, 2001
The only thing about Python that really annoys me is displaying floats as x.000...01. Maybe the lack of good information hiding in classes too, but having only written academic assignments that hasn't been a problem yet.

Shumagorath fucked around with this message at 21:06 on Jun 13, 2010

HFX
Nov 29, 2004

Shumagorath posted:

The only thing about Python that's really annoyed me is displaying floats as x.000...01. Maybe the lack of good information hiding in classes too, but having only written academic assignments that hasn't been a problem yet.

This should be handled by a string output format. As to the information hiding, there is a lot of classical languages that have no information hiding. Just write yourself getters and setters to access them, and get in the habit of using the getters and setters even in your own code. There is quite a few people who recommend putting a _ in front of the private members.

Jonnty
Aug 2, 2007

The enemy has become a flaming star!

HFX posted:

This should be handled by a string output format. As to the information hiding, there is a lot of classical languages that have no information hiding. Just write yourself getters and setters to access them, and get in the habit of using the getters and setters even in your own code. There is quite a few people who recommend putting a _ in front of the private members.

It's not just 'a few people' - that's the recommended way of doing it. A double underscore actually hides attributes (well, it really scrambles the method name, but they're as good as hidden).

doctor_god
Jun 9, 2002
php:
<?PHP

class Foo {
    var $bar null;
    
    function GetBarSingleton() {
        if ($this->bar === null) {
            echo "Creating the Bar";
            $this->bar = new Bar();
        }
        
        return $this->bar;
    }
}

class Bar {
    var $sum 0;
    
    function Add($value) {
        $this->sum += $value;
    }
}

$foo = new Foo();

$bar1 $foo->GetBarSingleton(); // Prints "Creating the Bar"
$bar2 $foo->GetBarSingleton(); // Prints nothing

echo $bar1 === $bar2 "true\n" "false\n"// Prints "true"

$bar1->Add(3);
$bar2->Add(5);

// Here's where things get weird

echo $bar1->sum "\n"// Prints "3" (Expected "8")
echo $bar2->sum "\n"// Prints "5" (Expected "8")

echo $bar1 === $bar2 "true\n" "false\n"// Prints "false" (Expected "true")

?>
I think this was fixed in PHP5, but still, I'm so glad I don't work on PHP anymore.

Plorkyeran
Mar 22, 2007

To Escape The Shackles Of The Old Forums, We Must Reject The Tribal Negativity He Endorsed
Having both assignment by value and assignment by reference in a language really isn't much of a horror.

Bhaal
Jul 13, 2001
I ain't going down alone
Dr. Infant, MD
Php changed it from version 4 to 5. In php 4: $obj = $other_obj was assignment by value, in 5 they changed it to assign by reference and introduced the 'clone' keyword to effectively copy an object.

Vinterstum
Jul 30, 2003

Plorkyeran posted:

Having both assignment by value and assignment by reference in a language really isn't much of a horror.

I'd say having to change such a fundamental feature of a language from one revision to another definitely counts as a programming language horror.

Adbot
ADBOT LOVES YOU

b0lt
Apr 29, 2005

Plorkyeran posted:

Having both assignment by value and assignment by reference in a language really isn't much of a horror.

It is when there's no way to check reference equality.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply