What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

My simple mind can't come to grips with the plethora of code snippets that get posted which are prone to SQL injection, yet here we are.

Is it considered a service to the community to point this fact out to those who post these? That is, is it appropriate to comment on a post indicating that it's prone to SQL injection?

I'm not talking about whether or not to downvote posts with vulnerable code, or catching it as a hot item, or wondering what to do when I don't feel like answering with non-vulnerable code. I'm wondering about repeatedly leaving a civil and informative comment indicating the vulnerability, specific to SQL injection.

It seems to me that there is still enough ignorance of SQL injection to make commenting on it worthwhile if the poster shows no indication of knowing that it's a bad thing. But I don't want to be that guy that just sits there whining that your code is vulnerable.

share|improve this question

closed as off-topic by Martijn Pieters, Al E., rene, Shadow Wizard, hims056 Jul 20 at 7:52

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question pertains only to a specific site in the Stack Exchange Network. Questions on Meta Stack Exchange should pertain to our network or software that drives it as a whole, within the guidelines defined in the help center. You should ask this question on the meta site where your concern originated." – Martijn Pieters, Al E., rene, Shadow Wizard, hims056
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Yes... it's always important to do so. It's a sure-fire way to get the pundit badge as well... –  ben is uǝq backwards Jan 24 '13 at 19:23
    
I like how the PHP mysql_* even has something akin to a whole FAQ post about it, because it's so widely (and insecurely) used. Though not directly connected to SQL injection as such, that issue is often another fault of code that uses mysql_*. –  J. Steen Jan 24 '13 at 19:26
    
This post should be migrated to meta.SO –  faintsignal Jul 19 at 18:31
    
@faintsignal why? there are other sites that deal with programming –  psubsee2003 Jul 19 at 23:05
    
@psubsee2003 True, but in this instance the discussion seems to be centred around SO. –  faintsignal Jul 20 at 0:38

2 Answers 2

up vote 14 down vote accepted

Of course it is appropriate.

Whenever you see something dangerous/stupid in posted code you should point it out, even if it is not the thrust of the question.

It doesn't matter if you choose to do it in an answer (as an aside) or as a comment (to either a question or an answer).

When I see a question that has code that is clearly open to SQL Injection, I comment on it.

The maxim of Stack Overflow is "Make the Internet a better place" - pointing out SQL Injection is just a part of that.

We don't only answer questions - we try to educate and explain and make better developers.

share|improve this answer
3  
Agreed. I would add: Don't just say "This is vulnerable"; explain the vulnerability; if possible give an example exploit. In my opinion the best way to learn about and understand these and other vulnerabilities is seeing how they can be exploited. –  balpha Jan 24 '13 at 19:30
    
Good, that is what I was hoping. Thanks! –  squillman Jan 25 '13 at 13:07

Yes it is. Because it still is a big problem.

Maybe add a self answered question about SQL injection. So there is a resource that can be used to link to.

share|improve this answer
4  
Because there are no existing resources on SO that discuss what SQL injection is... –  Servy Jan 24 '13 at 20:14

Not the answer you're looking for? Browse other questions tagged .