What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

A question on Stackoverflow contains PHP code (probably a wordpress plugin) that has classic SQL injection vulnerabilities. About half a dozen of answers copy&paste the code and fix the issue that caused the code not to work, without mentioning the SQL injection issue. If people later come upon the question and answers and decide to take it as an example, we will have even more insecure software around.

So, what is the correct way to handle it?

  • put in an answer that warns about the issue?
  • put in a comment that warns about the issue?
  • flag the question?
  • downvote the question?
  • edit the question to include a warning?
  • flag each answer that copy&pasted the code?
  • comment on each answer that copy&pasted the code?
  • downvote each answer that copy&pasted the code?

My main problem is that comments warning about the issue will not be easily noticed by visitors.

share|improve this question
    
ill do this by providing answer like stackoverflow.com/a/14108644/1723893 –  NullPoiиteя Jan 1 '13 at 7:23
1  
This is totally a dupe, but I can't find it. IIRC, the consensus was, in the limited case where the code in the question is broken and the answers copy/paste, it's not the responsibility of the people answering questions to fix the code. It always helps, of course, and such answers should generally get upvoted. –  Charles Jan 1 '13 at 7:30
    
There is a more recent dup than this one that I recall, but here's one: Is there a policy on dangerous answers? –  psubsee2003 Jan 1 '13 at 8:49
2  
And this isn't quite a dup, but related: How to deal with highly voted answers with security vulnerabilities? –  psubsee2003 Jan 1 '13 at 8:53
    
SO exists to answer programmers' questions; not to save the world from SQL injection attacks. –  Flimzy Jan 1 '13 at 10:20

1 Answer 1

up vote 5 down vote accepted

What is the correct way to handle it?

Here is what I think:

put in an answer that warns about the issue?

That would be great. Posting an answer that fixes OP's problem and also fixes the security issue separately

put in a comment that warns about the issue?

If unable to post an answer then adding a comment is always a good idea

flag the question?

An invalid flag if the post follows FAQ guidelines

downvote the question?

No. If OP has spent time to explain the question and context properly then downvote is not warranted

edit the question to include a warning?

No. I would term it as an invalid edit

flag each answer that copy&pasted the code?

An invalid flag. Community made an effort to help the OP, if the answers are inline to the question then no flagging is not valid

comment on each answer that copy&pasted the code?

Not a bad idea

downvote each answer that copy&pasted the code?

No. Same point as mentioned above for downvoting the question

share|improve this answer
    
This is what I was afraid would be true - the correct course of action is the one that won't really help... –  Jan Schejbal Jan 1 '13 at 11:44
    
I guess it would help. Correct action in my view is to post an answer, so future visitors know what is good and what is bad (and if they agree they will upvote the answer which talks about security fixes too). So it helps in the long run. I appreciate your concern but remember we are not here to force others to beef up their security, we can only provide helpful pointers. –  Aziz Shaikh Jan 1 '13 at 12:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .