5 ms·

"but this is the way it needs to be done." Actually, I'd disagree. It doesn't need to be done that way and this is a good example of a battle you're likely to l

"but this is the way it needs to be done." Actually, I'd disagree. It doesn't need to be done that way and this is a good example of a battle you're likely to lose that won't really cost you anything (other than some unpleasantness hand crafting SQL queries). I'd argue that even with significant opposition, any battle that needs to be won can. "I don't think we should store all the user passwords in plaintext on the server."

gwbas1c 10y ago
In that situation, the correct thing to do is get 1-2 people fired, or go find another job. Life is too short to work with people that incompetent.
heartsucker 10y ago
Please read about SQL injection[0]. Not using a library that escapes your strings is how Bobby Tables[1] ruins your production database. [0] - https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filtered_escape_characters https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filt... [1] - https://xkcd.com/327/ https://xkcd.com/327/
- sleepychu 10y ago
  Love that XKCD :-) Maybe I misunderstood what you had in mind when you wrote string concatenation but concatenating untrusted raw strings and using a library to construct SQL queries are not the only two ways to produce a SQL query.
- jacquesm 10y ago
  And this is exactly how one would deal with such a situation.
cookiecaper 10y ago
On the contrary, if you're working with people that dense, it's very unlikely that you'll make any progress on technical grounds. It's hard even among intelligent people. The reality is that most people do not make value judgments based on objective criteria of any kind. This is true even among technical people, who rapidly build religious precepts around their nearly-arbitrarily-chosen pet technologies and then discard anyone who doesn't present with the tokens and signs of their adopted technical religion, regardless of that person's true technical ability. People make judgments based on the amount of personal trust and goodwill they have toward the person making the argument. That's the natural status. With a lot of exercise, people can partially limit the effects of this impulse, but very few train at this in any significant way. The moral of the story is that the way to win arguments is to be well-liked. It's a popularity contest. If you want people to let you do what you want, you have to make them like you. The objective merits of whatever you're arguing about are practically irrelevant.

gwbas1c 10y ago

In that situation, the correct thing to do is get 1-2 people fired, or go find another job. Life is too short to work with people that incompetent.

heartsucker 10y ago

Please read about SQL injection[0]. Not using a library that escapes your strings is how Bobby Tables[1] ruins your production database. [0] - https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filtered_escape_characters https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filt... [1] - https://xkcd.com/327/ https://xkcd.com/327/

sleepychu 10y ago
Love that XKCD :-) Maybe I misunderstood what you had in mind when you wrote string concatenation but concatenating untrusted raw strings and using a library to construct SQL queries are not the only two ways to produce a SQL query.
jacquesm 10y ago
And this is exactly how one would deal with such a situation.

cookiecaper 10y ago

On the contrary, if you're working with people that dense, it's very unlikely that you'll make any progress on technical grounds. It's hard even among intelligent people. The reality is that most people do not make value judgments based on objective criteria of any kind. This is true even among technical people, who rapidly build religious precepts around their nearly-arbitrarily-chosen pet technologies and then discard anyone who doesn't present with the tokens and signs of their adopted technical religion, regardless of that person's true technical ability. People make judgments based on the amount of personal trust and goodwill they have toward the person making the argument. That's the natural status. With a lot of exercise, people can partially limit the effects of this impulse, but very few train at this in any significant way. The moral of the story is that the way to win arguments is to be well-liked. It's a popularity contest. If you want people to let you do what you want, you have to make them like you. The objective merits of whatever you're arguing about are practically irrelevant.