String#+

ruby-talk
1

The fact that this feature would make Ruby easier to learn was a
small twig on the fire

Well, perhaps it gives some material for an advanced Ruby class: how to
override methods you don't like.

class String
  alias oldplus +
  def +(other)
    oldplus(other.to_s)
  end
end

"hello"+5

I was generating SQL statements at the time.

Hopefully nothing like this:

sql = "select * from foo where key = '" + myvar + "'"

If you encourage your students to do that, sooner or later their databases
will get hacked :slight_smile:

Since the statement should invoke a quoting function anyway, that function
can do the implicit to_s that you want.

Regards,

Brian.

2

Hopefully nothing like this:

sql = “select * from foo where key = '” + myvar + “'”

If you encourage your students to do that, sooner or later their databases
will get hacked :slight_smile:

···

----- Original Message -----

I was generating SQL statements at the time.

This isn’t part of any tutorial; it’s for my own stuff. In any case, I
don’t see how you can say that the above code will eventually get the
database hacked. Clearly, it depends on where ‘myvar’ is coming from.
These are not strings from the cgi post hash! (I’m not evaling any strings
from the user, either. :slight_smile: ‘myvar’ could come from trusted session data, or
from a previous query…

Perhaps I’m not understanding you.

Chris

3

Hi,

sql = “select * from foo where key = '” + myvar + “'”

If you encourage your students to do that, sooner or later their databases
will get hacked :slight_smile:

This isn’t part of any tutorial; it’s for my own stuff. In any case, I
don’t see how you can say that the above code will eventually get the
database hacked. Clearly, it depends on where ‘myvar’ is coming from.

I think Brian was talking about the “SQL injection vulnerability”.
Consider:
myvar = “’ or ‘’ = '”

… you’ll end up with complete dump of foo. That’s not too bad in case
of select (as it will “only” show some quasi-sensitive data). Now consider
the same code with delete statement.

W.

···

–
Wejn <lists+rubytalk(at)box.cz>
(svamberk.net’s Linux section, fi.muni.cz student, linuxfan)

    Bored?  Want hours of entertainment?         <<<
      Just set the initdefault to 6!             <<<