34

I posted an answer on a question about PHP/MySQL, specifically something vaguely related to SQL injection prevention. I know this is a touchy subject for many developers, so I tried to be objective and provided a viable alternative reasoning.

A question got voted down with a comment, so I edited it to decrease ambiguity and make it more clear in general. However, the user in question would refuse my arguments and accuse me of cargo cult programming and cluelessness on string escaping.

I further engaged with him on chat where he would just iterate on what he had already said in comments and not provide any useful reasoning behind his decision at all.

Since I am moderately certain, my answer was at least a decent one, I would have normally just shaked it off. However, the user has quite a lot of reputation, and such behaviour does not agree with my perception of a high-reputation user.

In case I am actually terribly wrong, I will apologize, but I don't think I am. I am relatively new to SE (even though my account is 2 years old), so I may have disregarded some policy or guideline or something else.

I ended up flagging one of his comments as rude and I am not sure if that was the right thing to do. What should I do in case of such problems?

Oh, and the answer in question: https://stackoverflow.com/a/10481116/267885

| improve this question | |
  • 26
    Fact #1: "Your Common Sense" was formerly known as Col. Shrapnel. Fact #2: Search Meta for "Col. Shrapnel" and you'll see. – mmyers May 7 '12 at 13:43
  • 19
    The PHP tag is one of the more... boisterous tags we have. Apparently PHP developers tend to be a little more passionate than the average developer. And when I say "passionate", I mean bitter and angry and prone to lashing out. Unfortunately the ol' Colonel is having a bad time of it recently, and might need to take a little vacation. Or try a different programming language. – user1228 May 7 '12 at 13:46
  • 7
    As one of the top 30 [php] answerers, I can attest to all this. – BoltClock's a Unicorn May 7 '12 at 13:49
  • 14
    This issue has been addressed, sorry about that :( – Tim Post♦ May 7 '12 at 13:53
  • 8
    The number of ♦ on this post is dazzling :P – Lix May 7 '12 at 14:03
  • 14
    Well technically, you are kinda wrong - mysql_real_escape_string() is for escaping string data; if you use it to escape numeric data, you need to wrap the value in quotes, otherwise the value remains vulnerable. This is a subtle but vital detail, and a common misconception. – Pekka May 7 '12 at 14:05
  • I did that in the example provided. – user184036 May 7 '12 at 14:06
  • 11
    @Tibor but you didn't mention the difference :) I was made aware of the same thing by the same user. I agree he can be a dick, but one sometimes has to grudgingly admit he has a point. – Pekka May 7 '12 at 14:09
  • In which case, this wouldn't be an issue at all! If he would point out this detail, I would modify the question and apologize. That, he didn't do. – user184036 May 7 '12 at 14:10
  • 16
    Yeah. I agree it's not productive the way he does it. He should be willing to explain what he's talking about, or shut up. – Pekka May 7 '12 at 14:14
  • 7
    @Pekka He almost always has a point. He just has no idea how to express himself in a constructive manner. "Abrasive" doesn't begin to describe it. – user229044 May 7 '12 at 14:46
  • Lol, here was a comment, the only useful (yet absolutely harmless) one. I really hope it was an author, not some brave gaoler who wiped it out. – user186355 May 22 '12 at 17:32
  • 2
    @user186355 It was the author, he suddenly realized that being correct and being a dick are two different and unrelated things. – yannis May 22 '12 at 17:44