4 ms·
Using string concatenation to build paths or SQL queries. My previous boss is a big fan of this. I've frequently broken his stuff by adding or omitting trailing
by gargravarr 9y ago
Using string concatenation to build paths or SQL queries. My previous boss is a big fan of this. I've frequently broken his stuff by adding or omitting trailing slashes. The SQL injection potential is obvious.
Our ticketting system is written in-house and is a diabolical mess of Teach Yourself PHP In 24 Hours - every trope of poor PHP development is in there. Certain sensitive pages are so badly written they're IP-restricted to our office to reduce the chance of them being exploited.
And a major one - passwords as a 1337 spelling of the username. We use this A LOT.
- gargravarr 9y agoI should also add, another thing we do very wrong here - devs with admin access to production servers. Not only is there a vector for direct attack by compromising a large number of accounts, but if devs can (and do) change settings on production machines without Infrastructure knowing about it, you've got potential for silently breaking secure systems.