Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Sine a major goal of SO is to compile the best programming questions and answers on the internet, I'm wondering if there's more we can do to single out and/or correct cases where questions or answers contain exploitable code (see http://stackoverflow.com/questions/1180956/mysql-select-statement-group-by-unique which includes an sql injection vulnerability). I always try to point this out to authors, but I tend not to make edits so I don't change "the meaning" of the author.

One approach for this I though of was to create a special flag to be added to questions or answers noting that the included code or advice is unsafe. Alternatively, is it better to follow a hard "edit out" approach in these cases?

share|improve this question

(For those of us who don't have edit rights)

In the case of your example, I think answering with your own safe code and stating that it is also not vulnerable to SQL injection.

When the vulnerable code is in an answer, post the code in a new answer, and leave a comment pointing to it.

share|improve this answer

It is probably better to just edit the code and leave a note that you were making it SQL injection safe. Mainly because if we added a flag, some people would ignore it. Better to just make the code safe and risk someone not knowing exactly what its doing.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .