3 ms·

An UPDATE without a WHERE, or something close to it

• l0b0 5y ago
  My career in IT (at the uni support desk) started with me screwing up an UPDATE. The colleague setting up the internal system had typed in something close to `UPDATE users SET password = hash("`, and asked me to type in the password I wanted (this was the early 2000s and an internal system, so basically standard practice). In an effort to be "helpful" I finished the statement with `");` and pressed Enter. And that's how everyone had to reset their password.
  • wruza 5y ago
    That was one of my first thoughts when I learned sql. If there is no condition on modifying operation, it would be nice if it required ALLROWS in place of WHERE. Like UPDATE t SET x=1 ALLROWS and DELETE FROM t ALLROWS. Or at least some dummy condition like WHERE 1=1.