Page 6 - Monthly Archives: May 2025

eval in Bash takes a concatenated string and evaluates it a second time as a shell command, and that is exactly the problem: any unvalidated input flowing into that string can inject arbitrary commands. This article walks through concrete attack scenarios involving eval and introduces safe alternatives such as arrays, namerefs, and printf minus v, which achieve the same dynamism without command injection.

A classic firewall filters network traffic by IP address and port, but never sees what's actually inside an HTTP request. A Web Application Firewall inspects exactly that content and detects attack patterns such as SQL injection or cross-site scripting. This article explains the difference, covers rule types, false-positive tuning, and practical configuration basics for ModSecurity and cloud WAFs like Cloudflare or AWS WAF.

Git is generally considered robust because every object is identified by a hash of its content, but an object database built on SHA hashes is not immune to failing disks, killed processes, or accidentally deleted files. The built in git fsck command scans exactly that object database for inconsistencies and surfaces problems before they turn into real, irreversible data loss. This article explains what fsck actually checks, how to read its most common error messages, and which steps repair a damaged repository.

SQL injection has ranked among the most dangerous security flaws in web applications for decades, even though the technical solution has been known for just as long. Parameterized queries structurally separate code from data, least-privilege database accounts limit the damage in a worst case, and string escaping alone remains a fragile crutch with many documented bypasses.

Anyone who treats TypeScript as just PHP with types quickly trips over structural type checking, reference semantics for objects, and the absence of nominal typing. This article explains the fundamental difference between primitive and object types, contrasts TypeScript's duck typing philosophy directly with PHP, and surfaces the most common misconceptions developers bring along when switching.

Migrating Encore to AssetMapper does not mean rewriting the frontend, it means moving entrypoints, npm packages and Sass files piece by piece onto Symfony's built in importmap mechanism, until Node.js is no longer strictly required for the production build.

In an acquisition or funding round, technical due diligence often has a real say in the price. A manual audit of a codebase that has grown over years, done within a few days, runs into clear limits. This article shows how to use Claude to systematically prepare code quality, technical debt, and security risks for an investor report, and where the limits sit with very large legacy codebases.

A usage policy for Claude Code is worthless if no one can prove whether it is being followed. Auditing AI tool usage requires an audit trail that documents where AI generated code was created in the project, who reviewed it, and how this evidence can be presented during an internal review or a customer audit.

While external keyword tools show what people search for on Google, internal site search shows what people search for after they have already landed on your own site, and that is a fundamentally different, often underused data source. This article explains what insights internal search queries provide, how to systematically match them against existing content to identify gaps, and how to correctly set up the technical tracking in Analytics.

The page object pattern is meant to decouple tests from selectors and DOM structure, but in practice it often balloons into classes with hidden business logic and deep inheritance chains. This article shows what the pattern actually solves, which overengineering traps are common, what a minimal page object looks like, and when a test is better off without the pattern entirely.