In MySQL comparing zero to a string 0 = "any string" is always true!

So when you want to compare a string with a value of an integer column, you have to cast your integer value into a string like follows:

SELECT * from posts WHERE CAST(posts.comments_count AS CHAR) = '200'

Of course this is usually not what you want to use for selecting your data as this might cause some expensive database operations. No indexes can be used and a full table scan will always be triggered.

If possible, cast the compared value in your application to avoid rewriting all lines in the database. ActiveRecord does that automagically, for example.

PostgreSQL is not affected

PostgreSQL will throw an error when you compare an integer with a string without explicit casting.

In authentication, this behavior may be used to match rows without knowing a secret token:

Andreas Robecke

Say thanks5

Last edit

Over 1 year ago

Henning Koch

Keywords

conversion, comparison

License

Source code in this card is licensed under the MIT License.

Async control flow in JavaScript: Promises, Microtasks, async/await

Slides for Henning's talk on Sep 21st 2017.

Understanding sync vs. async control flow

Talking to synchronous (or "blocking") API

print('script start')
html = get('/foo')
print(html)
print('s...

Delivering Carrierwave attachments to authorized users only

Preparation

To attach files to your records, you will need a new database column representing the filename of the file. To do this, add a new migration (rails g migration <name>) with the following content:

class AddAttachmentToNotes...

Posted by Andreas Robecke to makandra dev (2012-02-21 15:14)

In MySQL, a zero number equals any string

PostgreSQL is not affected

Related security issue

Related cards:

Introduction

Understanding sync vs. async control flow

Talking to synchronous (or "blocking") API

Summary

Preparation