An Answer to my post for young programmers

Jay Kimble — Wed, 25 Jun 2008 01:15:35 GMT

My good buddy (actually my best friend from High School), "The Witt" complained that I wasn’t being helpful to programmers who are trying to learn the craft when I posted two weekends ago on "A Question you should ask when hiring a non-entry level developer." (OK, he wasn’t the only one... but, hey, we have a history, so he can get me to post a response, and you can’t... deal...)

I decided that our subsequent conversation in email would make a good followup post for those who want to know what they should be doing, and with his blessing I am posting an edited version.

[It started with this comment]

The Witt - OK I know that I am new to the ASP codeing info.
I understand the security issues ( or at least, what might happen with leaving every thing wide open). BUT, Having just completed two semesters of nothing but ASP I just don’t see what wrong... I AM NOT a seasoned programmer...and my classes taught us to connect inthis very manner you discribe...
can you eleborate for those of us that are trying to learn? show us what you would do instead?
thanks in advance

Jay (in Email now)- I know I probably made some harsh statements there (in my blog post). I meant it to be hard, but it was as much about seeing some consultant coming in and writing crappy code against my APIs and leaving HUGE security holes in my website.

The major point is for ASP.NET that you should always use Command objects with parameters... something like this (code may not compile cause its off the top of my head... there’s probably an error in there somewhere...)

        1: Dim query as string = "select field1, field2, field3 from someTable where ID = @TableID"

       2: Cmd.CommandText = query

       3: Cmd.Parameters.Add(new DbParameter("TableID", cbo.Value)

       4: ' Code continues....

The trick is in using the "@" variable in the query, and using the Parameters collection. When this gets shoveled down to the database it gets sent differently and if someone tries to change that "cbo.Value" within the http post by trying to add their own SQL it will fail.

I know that changing the variable in the http post statement sounds advanced... go here --> http://www.bayden.com/TamperIE/, download the TamperIE tool (for IE) and try it out... You’ll see that you can in fact force whatever values you want into the post.

As far as other dev environments go (I know you deal with a couple others), you want to figure out how to send a prepared statement to whatever SQL Server you are dealing with (ms access has these as well, so does Oracle and everything else I can think of... even the free PostgreSQL has them).

Anyway, I see you as someone who’s growing as a developer... you’d not go into an interview and present yourself as more than you are... that too is the problem...

Do you mind if I post this (more or less?) as a new blog post?

The Witt- I don’t mind in the least…

Like I said I am trying to learn. The “@” tucked in front… I always thought that was just to get the info from the current page. It’s nice to know what that really does. I do use that for most of my sites. I just never knew all the reasons.

I think that is the problem with a lot of the schools today. They are just pushing the students out and they really don’t know what they are doing. (Not that I always know what I’m doing).

---------------

Ok. it’s not all that edited. One more thing I forgot to mention. If you use an ORM or something that builds classes for you, then you probably are getting this type of functionality (just about every ORM I know of uses prepared SQL statements to push data). My favorite ORM is SubSonic (and I know others rave about NHibernate)... It the Java world I use Apache Cayenne (and people rave about Hibernate over there)

---------------

BTW, I take great pleasure in mentioning that The Witt turns $28 (that’s hex) in a little less than 2 months... unfortunately I turn $28 about 2 weeks before him.

Necessary Evil??

Jay Kimble — Fri, 09 May 2008 19:30:01 GMT

I want to write today about the 300lb Gorilla that none of us really wants to talk about. I'm talking about the people we use to find new jobs. As you may be aware I closed down IntraDynamics, LLC (well, I have greatly curtailed my company's offerings),and got a new job (at Answers Systems, Inc.)

I was "exchanging notes" with my new boss regarding the process and discovered some things (none of this is surprising, but you may want to think about it next time you are pursuing a new job).

I had two recruiters that were aware of my interview process with Answers. One was the company who placed me and the other was a company I trusted (in the past) who appeared to be working hard to place me somewhere else (even asking about where I was in the process with Answers). In fact I was actually told that Answers (who offered me a job in less than a week) was slow in their hiring process. All this makes sense (the other recruiting company was trying to get the fees for me and wanted to do the placement with Answers, so they needed me out of the way). They inappropriately asked Answers about me.

There's that side of things. The other is that it took a long time to get my deal finalized (almost another week). Why? Recruiter placement fees. Now mind you there was a slight change in things with me (I went from "contract to hire" to just "hire"). The company wanted as much as 35% of my yearly salary for placing me (now mind you it wasn't because they did a great job finding me, etc.. they were in the right place at the right time).

To be honest all Answers needed was someone else to pre-screen candidate's technical abilities. All that the placement firm did was monitor Monster.com and send out an email. There were a few additional things they did (like call me everyday regardless of whether there was new info or not).

I don't mean to be trashing on someone (that's why I left the company names out), but I was in shock of the fees they wanted to collect. My boss, Perry, and I started talking about what would be better.

Eric Wise' idea of having a computer programmers trade association seems like a good idea. We would pay dues, but the organization would allow us to take tests and "prove" our abilities (or at least allow it to be easier to pre-screen applicants). Maybe there would also be a mechanism for referring.

I've been thinking about this. We could do it now you know. We could set up a site to create the organization. There would need to be a set of testing sub sites (maybe you would only be allowed to test every 6 months or every year). When the companies we work for are looking for people we could simply look in the organizations site to see who is currently available and match up test thresholds to what we are looking for. We could then refer these folks to our companies avoiding the whole recruiting industry.

Maybe I'm just dreaming...