3 ms·
In a past life, I converted an intranet application for some government department from Oracle/Coldfusion. The whole application, every SQL query taking input,
by Macuyiko 10y ago
In a past life, I converted an intranet application for some government department from Oracle/Coldfusion.
The whole application, every SQL query taking input, was vulnerable to SQL injection.
For many insert operations, I'd find a pattern appearing of first inserting a row with some random value in one of the columns (`temp_key`), then performing a select based on this key to get the row back to know the primary key, and then continue to update other fields in the same row, and adding other records to other tables referencing this primary key.
Obviously, transactions was a foreign concept to the original developers. I still remember taking a deep breath once I found a code snippet that would try an insert again if the insert failed because the randomly generated `temp_key` was already used before, a problem that seemed to really start bothering them as the database grew larger...
- delgaudm 10y agoI'm stretching my memory as a "full stack" dev back in the 90s but I seem to recall that CF couldn't do transactions for its first few versions. People were begging for <cftransaction> to become a thing. I also don't remember being able to call an oracle stored procedure from CF in version 1 or 2.. But I'm hazy on that for some reason I remember the ODBC driver not supporting it. As a result I recall resorting to hacky stuff like what you describe. It wouldn't surprise me in the least if there is government cfml code out there from the 90's. It was a challenging time with far fewer tools.
- INTPenis 10y agoThat is how I learned to do SQL when I was learning how to code in ASP 2.0 and PHP 17 years ago. It seemd quite natural then and for several years onwards.