HN user

its2010already

22 karma
Posts3
Comments9
View on HN

It does make sense to be able to define business/application logic as reusable query components.

For example, if your PERSON entity has TITLE, FIRST_NAME and LAST_NAME fields, that little bit of logic that concatenates them together in the right way to form a full name is something that is useful to define. Likewise, setting up a join of tables that is used many times in your application is something that Korma will let you do.

Even though these components may be implementable on the database side (as user defined functions or views), it may not always be possible (or desirable) to do that way.

All I have to say is the guy writes pretty darn well for a 13-year old. Perhaps his experiment is flawed, but I was very impressed by his writing skills, and I know it will serve him well in the future.

Stop hating Java 15 years ago

I have a question...

The article states:

... Whenever you needed a pluggable system in your code you had to abstract away some concepts in order to make it work. Ruby lets us do it much easier and that’s cool. ...

Can someone give a concrete example of this?

The problem I always see with practically all templating systems is the lack of proper escaping of input data.

For example, the function 'tag-name' really needs to HTML-escape the input parameter content. The simple example (tag-name "div" "Hello world") breaks down when "Hello World" is replaced by a variable reference.

Fortunately this is an relatively easy problem to solve. A better definition for tag-name is something like:

(defun tag-name (name content) (html (format nil "<~A>~A</~A>" name (to-html content) name))

The function to-html will return the HTML-escaped version of content. The function html returns an object/string that marked as already being HTML-escaped. They work together so that (to-html (html x)) just returns x.

A similar type system can be set up to handle url escaping rules.

If the templating system doesn't keep track of what is escaped and what isn't then that burden is left to the programmer with all of the associated risks of producing malformed output and creating opportunities for injection attacks.