Five Techniques to Prevent Silent Balance Corruption in PHP Wallet Systems

·1 views

A common but hard-to-detect bug in homegrown wallet systems can silently corrupt user balances when two database operations occur simultaneously, a problem known as a lost-update race condition. PayWithToken, a payments platform, documented five engineering disciplines used to eliminate this risk in their PHP/MySQL stack. The fixes include performing arithmetic directly in SQL rather than in application code, storing monetary values as DECIMAL instead of floating-point numbers, and guarding debit operations within the database WHERE clause. Credits are made idempotent by tying each transaction to a unique payment reference that can only be claimed once, preventing duplicate crediting. All multi-step money movements are wrapped in database transactions to ensure they either complete fully or not at all.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How SQL Strings Are Parsed Into Structured Commands in a Custom Database

A developer building a custom transactional key-value store from scratch has reached the query layer, where raw SQL strings must be translated into structured operations. The storage engine natively understands keys, values, and SSTables but has no concept of SQL, so a dedicated parsing layer is required. The parser converts statements like CREATE TABLE, INSERT, and SELECT into structured objects called Abstract Syntax Trees (ASTs), separating grammar validation from database execution logic. Each AST struct captures relevant details — such as table name, column definitions, and query conditions — without performing type conversions or storage operations. A follow-up post will cover how these parsed structs are translated into actual bytes written to disk.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Suddo tool lets AI agents handle sudo password prompts without switching terminals

A new open-source tool called Suddo aims to solve a common friction point when using AI coding agents that need to run privileged system commands. Most AI clients, such as Claude Code, lack support for pseudo-terminal (PTY) creation, forcing users to switch to a separate terminal just to enter a sudo password. Suddo works as an MCP server tool called execute_command, which intercepts sudo requests and applies user-defined rules to reject or allow them. If a command is permitted and no valid sudo timestamp exists, the tool prompts the user for their password directly within the AI chat interface. The project is available on GitHub under the username sunu15712.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Most Developers Use the Word 'Namespace' Incorrectly

A developer essay argues that the term 'namespace' is widely misused because explanations focus on its function rather than its literal meaning — the space to which a name belongs. The author classifies a namespace as a conceptual specification, not a tool, and outlines which verbs correctly describe the relationship between code entities and namespaces. Common expressions such as 'add a namespace' or 'use a namespace' are flagged as grammatically or conceptually inaccurate. The piece uses Ruby as a primary example, explaining how class and module names are constants that can be nested, while general constants cannot serve as outer namespaces. The author also notes that Ruby's constant lookup combines lexical nesting and inheritance, which affects how outer namespace constants can or cannot be referenced.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agent Approvals Need More Than a Boolean Flag to Stay Valid

A technical analysis published on DEV Community argues that human approval in AI agent workflows is not a permanent authorization but a time-bound decision tied to specific conditions. When an agent task is approved at one moment and executed hours later, critical factors such as refund status, policy rules, approver authority, or task arguments may have changed in the interim. The article illustrates this with a refund scenario where a CNY 199 request approved at 10:00 finally reaches dispatch at 15:00, by which point multiple assumptions underlying the original approval could be invalid. The author identifies five distinct concepts — approval intent, decision, evidence, validity, and final business authority — that production systems must evaluate separately rather than collapsing into a single approved flag. The piece concludes that robust agentic systems must bind each approval to a concrete execution envelope capturing the subject, capability, arguments, policy version, and expiry time.

0 comments Read more at DEV Community