4 ms·

Damn that SQL injection will get you owned in 3 seconds or less :D

• aurbano 6y ago
  It really really sucks that it’s almost 2021 and we still have to try to sneak in a little SQL injection just to see if they know about it... Ffs is that never going to go away?
  • jolux 6y ago
    the only way it could possibly go away for good is database libraries that don’t support dynamic SQL. But you almost always need the flexibility at some point, and SQL is so powerful that taking it off the table is hard to justify.
    • alltakendamned 6y ago
      just use prepared statements instead of string concantenation to build your SQL statements.
      • SamuelAdams 6y ago
        Yes, there's lots of ways to fix SQL injection. I'm more surprised that after knowing about this vulnerability for 20+ years, its STILL lost on many developers. You and I pick up on it immediately, but there's (apparently) a lot of developers who think the code is "good enough, works for me" and ship it to production. So it needs to be asked for in interviews, and if you find it and discuss it you're apparently one of the "better" programmers. The bar for being a passable programmer is literally on the floor.
      • jolux 6y ago
        Absolutely, but most database libraries still allow concatenation.