3 ms·
My current employer has asked me to forget about "SQL Injection `problems`" and told me to focus on the deadline. sigh
by meric 16y ago
My current employer has asked me to forget about "SQL Injection `problems`" and told me to focus on the deadline. sigh
- cookiecaper 16y agoSubmit an exploit anonymously somewhere where it will get published. Obviously, don't indicate that you're an employee. A big benefit of full disclosure is that it doesn't allow companies to sit around and ignore security problems without facing serious liability risks at the very least.
- patio11 16y agoThis came up in our engineering ethics class in college. Suppose you said "No, that is unethical / professional irresponsible / etc." or its effective-but-weasley younger brother "Please document that request in writing."?
- meric 16y agoDon't worry, I ignored his request. :)
- jrockway 16y agoI've never used any library to communicate with a database that made safe code harder to write than unsafe code, so I don't see how this will be an issue.
- code_duck 16y agoIt's not difficult to avoid, is it? Sanitize input and use parameterized statements. I'd take longer to not do those things, personally.
- meric 16y ago"`problems`" in scary quotes. :)