What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 129 Stack Exchange communities.

Should question, or answers for that matter, with SQL Injection or other security issues be down voted?

I lean towards down voting them, so if in the future someone finds the question, the number of down votes may lead them to question the validity of the question.

share|improve this question
13  
Why would you downvote a question containing SQL injection? Wouldn't it be better to just point out the problem? That would be like downvoting someone because their code threw an exception. That's why people come here and ask questions. –  jadarnel27 Jun 18 '12 at 13:25
    
Voting to close as "not constructive"? Can't we ask valid questions on meta anymore? –  Matt Jun 18 '12 at 13:25
3  
@Matt I don't see why it's not a valid question. Although I think that the general question here (what's a valid reason to downvote) is a dupe many times over. As we can see from the "Related" sidebar =) –  jadarnel27 Jun 18 '12 at 13:28
5  
Downvotes are not a code review tool. Except on Code Review...and even then only on answers –  Ben Brocka Jun 18 '12 at 13:38
    
@John This is one such question where it is extremely tempting to downvote a question because of the presence of SQL injection attacks, since it's so blatantly vulnerable code (not even a mysql_real_escape_string in sight), but I choose to post a strongly-worded answer instead. –  Ricardo Altamirano Jun 19 '12 at 0:12

2 Answers 2

up vote 31 down vote accepted

Downvoting a question containing a SQL injection hardly makes sense. Add a comment highlighting the problem instead - unless it already is the issue that the question is about.

Downvoting an answer that contains a SQL injection is a valid use of your vote IMO, even though it's rarely done. Still, the more important thing to do is to point out the problem in a comment - that is the best warning sign for future generations.

In some cases, it can also be appropriate (and nice) to edit the answer to fix the problem.

share|improve this answer
5  
My thoughts exactly, +1. The only reason I could think of for downvoting a question with SQL Injection is if, in the question, the author is admitting to knowledge of the vulnerability and saying they don't see the point in fixing it. Even then, I'm kind of on the fence. –  jadarnel27 Jun 18 '12 at 13:30
4  
@jadarnel yeah, the "I know there are vulnerabilities but I need to get this working urgently" kind, that happens often and I'm on the fence too (seeing as it's their own grave they're digging) –  Pëkka Jun 18 '12 at 13:31
    
@Pekka +1 for phrasing it more succinctly than I did. In relation to php (the language I know best, which is why I reference it) I'm almost tempted to down vote answers where I see people recommending the mysql_* functions because it's so simple to avoid SQL injection with the non-deprecated functions. –  Ricardo Altamirano Jun 18 '12 at 13:34
2  
@pythonscript yeah. Those functions' time is definitely over, and I notice you are one of those constantly adding comments to that effect. Keep up the good work - it's comments like those that will slowly change the way people do it. even though you won't get many thanks for it. Downvoting mysql_* answers and saying so might cause you more grief and discussions than it may be worth, though :) –  Pëkka Jun 18 '12 at 13:38

Certainly in an answer. It's just a poor answer if it contains an easily preventable vulnerability, but I would also point out the problem in a comment.

However, I wouldn't necessarily down vote the question on that reason alone, and I especially wouldn't down vote the question without providing any explanation of the injection vulnerability. On questions in the php section, I'm starting to work this information into my answer (sourced and modified from here for this) as a standard way to try to dissuade new php coders from exposing their code to such vulnerabilities.

Something similar could probably be worked into responses to other questions, although I avoid using this as my entire answer. Otherwise it's a fairly direct RTFM answer that may not directly help the original poster of the question.

--

Please don't use mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process (see the red box). Instead, you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you care to learn, this is a good PDO tutorial.

--

share|improve this answer
    
I don't see the harm as long as: 1) not being rude 2) offering constructive advice 3) not trying to shut down the question for asking (see also: meta.stackexchange.com/questions/8891/…) –  Shog9 Jun 19 '12 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .