3 ms·
Actually, most 'injection' issues happen because of poor programming practices (not sanitizing input, not escaping SQL parameters, etc.) and not because databas
by dguaraglia 10y ago
Actually, most 'injection' issues happen because of poor programming practices (not sanitizing input, not escaping SQL parameters, etc.) and not because databases don't support Unicode characters. It's not the OP or the grandparent's fault for not having a "nice-to-shitty-programs" name.
- lmm 10y agoSure, but poor programming practices come down to cost like anything else - whether they're due to low-quality programmers, lack of training, poor management or whatever. No-one is deliberately choosing to make their site worse.
- dguaraglia 10y agoTrue. Hiring better programmers is more expensive, but in the case of vulnerabilities the long-term cost of not doing the right thing are probably higher than the upfront cost of hiring someone more qualified. The original tweet, for example, reeked of crappy hand-crafted PHP code. Pretty much any web framework, even PHP ones, wrap bare exceptions like that into a proper 500 error with no information about the underlaying system. How long will it take for someone to put two and two together (MariaDB, no escaping of user input, a users table of some sort) and come up with a SQL injection that exposes all the password hashes for that website?