3 ms·
Well, back in the "olden days" in the late 90's, this was actually pretty common: ColdFusion allowed SQL statements to be embedded in the templates, and JSP had
by commandlinefan 6y ago
Well, back in the "olden days" in the late 90's, this was actually pretty common: ColdFusion allowed SQL statements to be embedded in the templates, and JSP had sql tags. IIRC, most people moved away from that model primarily for flexibility and maintainability: having SQL statements mixed in with the presentation led to a lot of code duplication and made putting a different front-end (say, a third party API) nearly impossible.
- edgyquant 6y agoI use to build sites in PHP where the front and backend were basically the same thing, with only the database existing outside the single codebase. It was definitely common for there to be sql injection vulnerabilities and years later i shuttered at the thought of some of those companies still writing code I wrote when I was young and knew almost nothing I’d security. Luckily now days most of them have switched to new code bases (or went out of business) but this wasn’t the case even 2-3 years ago.
- commandlinefan 6y agoI wondered about that, too, but I'd be hard-pressed to say whether SQL injection vulnerabilities are more or less common if you embed SQL in the front-end vs. in a back-end service. I supposed they would be slightly easier to identify and exploit in a more modern front-end like React because the source code is actually viewable to users.