3 ms·

In addition, this is the year 2009. SQL INJECTION by a company this big? Thats rather sad. My final project in class gets and instant 0/100 (40% of the grade)

In addition, this is the year 2009. SQL INJECTION by a company this big? Thats rather sad. My final project in class gets and instant 0/100 (40% of the grade) if SQL injection was possible...

jrockway 17y ago
And yet, companies with software with SQL injection bugs still make plenty of money. If only the real world was more like academia...
- spoondan 17y ago
  And some of those companies get caught out and lose a lot of money for it. I'd rather retake the failed class. The real world is harsher than academia.
  - jrockway 17y ago
    But if the company spent its time solving every theoretical security problem, it would have never had a product to make money with in the first place. It is a balance, and "zero tolerance" is silly. (So is not using a modern database abstraction library. Even PHP has them these days!)
potatolicious 17y ago
Ehh... SQL injections are not on the same order of seriousness as storing passwords in plaintext, IMHO. The average web service has a complexity far greater than any college course project. SQL injections can be mitigated using the correct tools and methodology, but things like this (and buffer overflows) will continue to exist. Such is the nature of things. There's "oh man, this one variable isn't sanitized", which is a bad, but understandable mistake. Then there's "oh man, we don't encrypt our passwords AT ALL", which really belongs in the realm of mistakes made by 15 year-olds. No seriously, the last time I made that mistake was when I was 15.
- deleted 17y ago
  [deleted]
epochwolf 17y ago
Wordpress has all kinds of security issues involving sql injection and code injection. SQL Injection is very very common. I've worked on sites that never sanitize anything.
Shamiq 17y ago
hehe...mind if i take a look at the source?
snorkel 17y ago
It's 2009 and there are still app frameworks not using parameterized statements?

In addition, this is the year 2009. SQL INJECTION by a company this big? Thats rather sad. My final project in class gets and instant 0/100 (40% of the grade) if SQL injection was possible...

jrockway 17y ago

And yet, companies with software with SQL injection bugs still make plenty of money. If only the real world was more like academia...

spoondan 17y ago
And some of those companies get caught out and lose a lot of money for it. I'd rather retake the failed class. The real world is harsher than academia.
- jrockway 17y ago
  But if the company spent its time solving every theoretical security problem, it would have never had a product to make money with in the first place. It is a balance, and "zero tolerance" is silly. (So is not using a modern database abstraction library. Even PHP has them these days!)

potatolicious 17y ago

Ehh... SQL injections are not on the same order of seriousness as storing passwords in plaintext, IMHO. The average web service has a complexity far greater than any college course project. SQL injections can be mitigated using the correct tools and methodology, but things like this (and buffer overflows) will continue to exist. Such is the nature of things. There's "oh man, this one variable isn't sanitized", which is a bad, but understandable mistake. Then there's "oh man, we don't encrypt our passwords AT ALL", which really belongs in the realm of mistakes made by 15 year-olds. No seriously, the last time I made that mistake was when I was 15.

deleted 17y ago
[deleted]

epochwolf 17y ago

Wordpress has all kinds of security issues involving sql injection and code injection. SQL Injection is very very common. I've worked on sites that never sanitize anything.

Shamiq 17y ago

hehe...mind if i take a look at the source?

snorkel 17y ago

It's 2009 and there are still app frameworks not using parameterized statements?