My simple mind can't come to grips with the plethora of code snippets that get posted which are prone to SQL injection, yet here we are.
Is it considered a service to the community to point this fact out to those who post these? That is, is it appropriate to comment on a post indicating that it's prone to SQL injection?
I'm not talking about whether or not to downvote posts with vulnerable code, or catching it as a hot item, or wondering what to do when I don't feel like answering with non-vulnerable code. I'm wondering about repeatedly leaving a civil and informative comment indicating the vulnerability, specific to SQL injection.
It seems to me that there is still enough ignorance of SQL injection to make commenting on it worthwhile if the poster shows no indication of knowing that it's a bad thing. But I don't want to be that guy that just sits there whining that your code is vulnerable.