4 ms·

> In the end we didn't get rid of SQL cause of SQL Injection. We fixed the frameworks and promoted the solutions. I mostly agree with you, but this is a bad ex

> In the end we didn't get rid of SQL cause of SQL Injection. We fixed the frameworks and promoted the solutions. I mostly agree with you, but this is a bad example. SQL injection is sadly still very far from a solved problem.

moron4hire 4y ago
No, SQL injection is a solved problem. There are just poorly trained/idiotic/lazy developers who don't use the solution.
- naikrovek 4y ago
  you sound far too confident in that answer for it to be the actual correct answer.
  - 988747 4y ago
    Database drivers for mabny programming languages have something like Java's PreparedStatement which allows you to compile the SQL query together with code, before the application is ran. Whatever input is provided later by the user cannot result in SQL injection, because it is not parsed/compiled at all. So yes, SQL injection is a solved problem, it's up to you whether you know about/use the solution.
    - im3w1l 4y ago
      The issue is that the type system doesn't enforce that the query is a literal / bundled resource.
    - tremon 4y ago
      The SQL language is not flexible enough to allow preparation of every possible query, so the problem is fundamentally not solved. To take a simple example: query parameters are not supported in DDL or DCL statements, and in DML queries the usage of parameters is limited to values only: even such a simple thing as an ORDER BY clause cannot be controlled by parameter insertion. "We have solutions for the most common occurrences" is not the same as "the problem is solved".
  - mrguyorama 4y ago
    >you sound far too confident in that answer for it to be the actual correct answer. What kind of non-argument is that?
    - naikrovek 4y ago
      > What kind of non-argument is that? the "comment" kind.
- BiteCode_dev 4y ago
  Depends if you define a solved problem as a problem with a known solution (theory) or as a problem people still pay the cost for in the wild (practice).
  - mmmpop 4y ago
    >> solved Oof classic 3rd rail for when you're arguing with CS grads
    - mmmpop 4y ago
      CS grads don't like being generalized, I knew that
- rwalle 4y ago
  Nah. Show me evidence it is "solved".
ncmncm 4y ago
That is what makes it a good example: SQL injection is still a million problems that would need to be fixed in a million places, and will never be. Leap seconds are a nuisance and source of bugs in a million programs. Fix them here, fix them there, it will always be wrong in the majority.
afiori 4y ago
Anything Injection has a well defined solution of "properly escape parameters". deciding how time should be represented is a completely different issue.

moron4hire 4y ago

No, SQL injection is a solved problem. There are just poorly trained/idiotic/lazy developers who don't use the solution.

naikrovek 4y ago
you sound far too confident in that answer for it to be the actual correct answer.
- 988747 4y ago
  Database drivers for mabny programming languages have something like Java's PreparedStatement which allows you to compile the SQL query together with code, before the application is ran. Whatever input is provided later by the user cannot result in SQL injection, because it is not parsed/compiled at all. So yes, SQL injection is a solved problem, it's up to you whether you know about/use the solution.
  - im3w1l 4y ago
    The issue is that the type system doesn't enforce that the query is a literal / bundled resource.
  - tremon 4y ago
    The SQL language is not flexible enough to allow preparation of every possible query, so the problem is fundamentally not solved. To take a simple example: query parameters are not supported in DDL or DCL statements, and in DML queries the usage of parameters is limited to values only: even such a simple thing as an ORDER BY clause cannot be controlled by parameter insertion. "We have solutions for the most common occurrences" is not the same as "the problem is solved".
- mrguyorama 4y ago
  >you sound far too confident in that answer for it to be the actual correct answer. What kind of non-argument is that?
  - naikrovek 4y ago
    > What kind of non-argument is that? the "comment" kind.
BiteCode_dev 4y ago
Depends if you define a solved problem as a problem with a known solution (theory) or as a problem people still pay the cost for in the wild (practice).
- mmmpop 4y ago
  >> solved Oof classic 3rd rail for when you're arguing with CS grads
  - mmmpop 4y ago
    CS grads don't like being generalized, I knew that
rwalle 4y ago
Nah. Show me evidence it is "solved".

ncmncm 4y ago

That is what makes it a good example: SQL injection is still a million problems that would need to be fixed in a million places, and will never be. Leap seconds are a nuisance and source of bugs in a million programs. Fix them here, fix them there, it will always be wrong in the majority.

afiori 4y ago

Anything Injection has a well defined solution of "properly escape parameters". deciding how time should be represented is a completely different issue.