@craigfrancis@mastodon.social

Craig Francis @craigfrancis@mastodon.social · Jul 24, 2026

Replying to @fesshole@mastodon.social

@fesshole@mastodon.social wait until you see the private sector, some of the things I’ve seen are just unbelievable. (recently the “Lead Architect” asked an AI how to connect to a production server, and copy/pasted the conversation into the terminal; also the team started creating invoices without an invoice number because it “was deemed unnecessary”; and set VAT to 0.2%, and 2000%; every week there is something… it’s been 3 years of this, I want to get off).

2

0

Craig Francis @craigfrancis@mastodon.social · Apr 02, 2026

Replying to @craigfrancis@mastodon.social

@mudri@mathstodon.xyz it’s a similar problem with HTML, where templating libraries take HTML string fragments that shouldn’t contain user values; in Go there is safehtml: https://github.com/google/safehtml Where they use the "un-exported string type" to ensure the HTML fragments are there during compile time: https://github.com/craigfrancis/php-is-literal-rfc/blob/main/others/go/index.go

0

Craig Francis @craigfrancis@mastodon.social · Apr 02, 2026

Replying to @mudri@mathstodon.xyz

@mudri@mathstodon.xyz ideally it wouldn’t use parsed strings (must confess I normally deal with higher level languages), but I find SQL gets complicated without the SQL syntax (e.g. trying to use function calls to create a WHERE clause), and some query builders still use SQL string fragments where user values shouldn’t be included: https://github.com/craigfrancis/php-is-literal-rfc/blob/main/justification/mistakes.php

0

1

0

Craig Francis @craigfrancis@mastodon.social · Apr 01, 2026

Replying to @mudri@mathstodon.xyz

@mudri@mathstodon.xyz Sorry if I’ve missed it, but is there a way to verify if a String has been defined in the source code… this allows a library to ensure application developers haven’t introduced any Injection Vulnerabilities with SQL, HTML, CLI, etc… e.g. verifying argument 1 to a function is an SQL string literal (a developer defined string), with user values being passed as separate arguments/parameters (not concatenated) https://eiv.dev

1

3

0

Craig Francis @craigfrancis@mastodon.social · Mar 24, 2026

Replying to @brucelawson@social.vivaldi.net

@brucelawson@social.vivaldi.net regarding PDF, and how they are not accessible by default… you know how web pages are so much easier to make accessible; could there be a way to make them self-contained/secure? https://github.com/craigfrancis/wdoc

0

Craig Francis @craigfrancis@mastodon.social · Mar 13, 2026

Replying to @patrickbrosset@mas.to

@patrickbrosset I’d be interested in that, and I’m sure others would be as well, I just can’t predict how much it would be used (says he often finding websites with bad caching setups, and they don’t seem to care).

1

0

Craig Francis @craigfrancis@mastodon.social · Mar 12, 2026

Replying to @patrickbrosset@mas.to

@patrickbrosset ignore my input as I’m not currently using a Service Worker, but this is interesting… is the idea to allow something like a user initiated refresh (they press button) to cause a full redownload of everything from the server, vs a JS initiated refresh to work more from the cache?

0

2

0

Craig Francis @craigfrancis@mastodon.social · Mar 01, 2026

Replying to @bohwaz@mamot.fr

@bohwaz yep, that’s probably fine, but I’m not worried about you, I’m worried about the vast majority of developers, and those who aren’t exactly writing the code themselves :-)

1

0

Craig Francis @craigfrancis@mastodon.social · Mar 01, 2026

Replying to @bohwaz@mamot.fr

@bohwaz true, and I think SQLite has some really cool features like that… personally I’m trying get MySQL and MariaDB to implement a very simple WHERE id IN (?) with a single placeholder for multiple values, as I still keep seeing people implode(‘, ‘, $ids) directly into the SQL string for some of that SQL Injection fun :-)

0

1

0

Craig Francis @craigfrancis@mastodon.social · Mar 01, 2026

Replying to @bohwaz@mamot.fr

@bohwaz tbh I’ve not used this, but MySQL does have the System Variable log_queries_not_using_indexes, which I assume would push you towards using an INDEX on all queries (but the docs suggest to me it’s more about queries that return all rows):

https://dev.mysql.com/doc/refman/9.6/en/server-system-variables.html#sysvar_log_queries_not_using_indexes

0

4

0

Craig Francis

Posts

Remote instance