4 ms·
Definitely a step into the right direction! It's just scary how many bad developers are passing unescaped values into SQL statements. I remember one guy who wa
by pstadler 15y ago
Definitely a step into the right direction! It's just scary how many bad developers are passing unescaped values into SQL statements.
I remember one guy who was a PHP developer at the company for years. He was really good at it though. However during my apprenticeship I asked him about best practices querying databases and showed him my code.
Looking at it he said: "Why the hell would someone escape those values? It's a database, not the Pentagon."
- pak 15y agoI think people need to be educated that SQLI bugs (errors in escaping) lead to usability issues as well as security issues. I can't count the number of times I've searched for something on a clearly handmade site and watched in amusement as my search query grows backslashes while paging through the results. Also, single quotes show up in more places than people realize: I've seen them in proper names, street addresses, uploaded filenames... if those things break your app or damage data, that should be a tangible concern.
- mildweed 15y agoAnd my favorite place, email addresses. Valid. Rare, but valid.