Dangers of AI coding tools

I've written hundreds of thousands of lines of code over fifteen years; writing certain types of code has become tedious and, frankly, boring. File upload, CRUD, forms?.

This is why I use AI, it can scaffold me and let me focus on more interesting things.

However, I don't blindly copy and paste, I review all generated code and make optimizations or adjustments if needed.

A simple vulnerability

Hone your skills first, it may be tempting to rely solely on AI, but this is dangerous because you are relying on a tool that may give wrong advice. Without experience, you may not notice the difference.

Here’s an AI-generated example:

<code class="language-php">     if ($request->hasFile('file')) {
            $file = $request->file('file');
            $fileName = Str::uuid() . '.' . $file->getClientOriginalExtension();

            // 存储在 public/storage/uploads/tinymce
            $path = $file->storeAs(
                config('tinymce.upload_path'),
                $fileName,
                'public'
            );

            return response()->json([
                'location' => Storage::url($path)
            ]);
        }</code>

This is a basic example, but it illustrates my point well. There are a lot of bugs here, but the most important is that there is no MIME type validation.

This code may work fine, it will upload the file and return a success message. A junior developer might go ahead and assume everything is fine!

The problem is that when a malicious user uploads a bad file that may contain a virus or some kind of hack, your entire application and your users are also at risk!

A better approach is to use Laravel's validator and apply some validation rule checks:

<code class="language-php"> $request->validate([
    'file' => 'required|file|image|mimes:jpeg,png,jpg,gif|max:5120'
 ]);</code>

Advice for junior developers

Should you use AI? certainly! It's totally fine to use AI to find information quickly and even generate code where it makes sense.

But don’t just rely on AI to write code, and don’t trust it blindly. Expand your knowledge by reading books by well-known authors, following podcasts from top developers, reading blogs, and practicing, first on your own. Understand the logic behind the code you are writing or letting the AI ​​write.

The above is the detailed content of Dangers of AI coding tools. For more information, please follow other related articles on the PHP Chinese website!