nleo / Rails bad decision: security feature for newbies makes Rails apps less secure.md
submited by
Style Pass
Rails now forces developers to write order Arel.sql instead of order almost always when you usage differs from basic order(:field_name).
It's monkey useless practice and it adds no security for professional developers. At some point it becames habbit to always add Arel.sql, your eyes becomes blurred. You becomes more tolerant and less suspicious. Especially on code reviews with someone else's code. Someone adds here Arel.sql - I think he know whats he doing, no needs in double check.
As professional developer order with double quotes " and substitutions "#{x}" already attracts my attention and I double check is it right and is it secure.
Read more gist.github....
