`src/content/posts/2026-05-26-nine-copies-of-the-same-function.md`

52 lines

---
title: "Nine Copies of the Same Function"
description: "The same HTML-escaping helper had been pasted into nine files. Deduping it — and adding the first real test suite — was the highest-leverage hour of the day."
date: 2026-05-26
tags: ["refactoring", "code-quality", "testing", "maintainability", "founder-log"]
---

Today I went looking for one bug and found a structural one instead: the same little HTML-escaping function had been copy-pasted into nine different files. Nine. That's not a bug yet — but it's a bug generator, and it was worth stopping to fix.

## The Problem

Escaping user-supplied text before it hits HTML is security-critical — it's how you stop content from becoming code. So the *last* thing you want is nine slightly-different copies of that logic drifting apart over time.

The danger with duplicated logic isn't that it's ugly. It's that the copies diverge. You fix a bug in one, forget the other eight. You harden one against a new edge case, leave the rest soft. Eventually "the escape function" isn't one thing with one behavior — it's nine things that happen to share a name, and you can't reason about any of them.

## The Fix

Two moves, in order:

1. **Collapse the nine into one.** I extracted a single shared helper and pointed every call site at it. Now there's exactly one place escaping happens, one place to fix it, one behavior to reason about. I did the same for a set of structured-data builders that had similar copy-paste sprawl.

2. **Add the safety net first.** Before and around the refactor, I stood up a real smoke-test suite — a few dozen fast tests that assert the important behaviors. That's what makes a refactor safe: the tests are the thing that tells you the "no behavior change" refactor actually didn't change behavior.

Order matters. The tests aren't a victory lap after the refactor — they're the permission slip to do it at all.

## The Lesson

**Duplication is a slow leak, and the fix is cheap while it's still small.** Nine copies is annoying; nine *divergent* copies is a security incident waiting for the wrong Tuesday. The moment you notice the same logic in more than a couple of places — especially security-relevant logic — that's the signal to consolidate, while it's still a mechanical change and not an archaeology project.

And you consolidate behind tests, not vibes. A refactor without a safety net is just moving code and hoping.

## Why This Matters for Business Owners

"It works, don't touch it" is how small, invisible risks compound into expensive ones. Duplicated critical logic is the classic example: everything's fine until the day one copy gets a fix the others don't, and now you have inconsistent behavior nobody can explain. Paying down that debt while it's tiny — one shared function, one test suite — is far cheaper than the incident it prevents. With AI assistance, an hour of this pays for itself many times over.

## Let's Connect

I build AI-powered automation for real businesses — not demos, not prototypes, production systems that run 24/7.

If you're a **founder, entrepreneur, or small business owner** looking to automate operations with AI, let's talk:

- [**@agentabrams on YouTube**](https://youtube.com/@AgentAbrams) — walkthroughs and demos
- [**@agentabrams on X**](https://x.com/agentabrams) — DMs open
- [**@agentabrams on Bluesky**](https://bsky.app/profile/agentabrams.bsky.social) — follow along
- [**goodquestion.ai**](https://goodquestion.ai) — you're here

**Advisory & Board Opportunities:** I'm actively looking to join boards where AI automation can drive real business value. If your company is exploring AI-driven operations, data pipelines, or autonomous agent systems — I'd love to contribute as a board member or advisor. Reach out on any platform above.

---

*Built with [Claude Code](https://claude.ai). Shipped in production. Every day. This is what one founder + AI looks like.*