Should question, or answers for that matter, with SQL Injection or other security issues be down voted?
I lean towards down voting them, so if in the future someone finds the question, the number of down votes may lead them to question the validity of the question.
Downvoting a question containing a SQL injection hardly makes sense. Add a comment highlighting the problem instead - unless it already is the issue that the question is about.
Downvoting an answer that contains a SQL injection is a valid use of your vote IMO, even though it's rarely done. Still, the more important thing to do is to point out the problem in a comment - that is the best warning sign for future generations.
In some cases, it can also be appropriate (and nice) to edit the answer to fix the problem.
mysql_* functions because it's so simple to avoid SQL injection with the non-deprecated functions.
Commented
Jun 18, 2012 at 13:34
mysql_* answers and saying so might cause you more grief and discussions than it may be worth, though :)
Certainly in an answer. It's just a poor answer if it contains an easily preventable vulnerability, but I would also point out the problem in a comment.
However, I wouldn't necessarily down vote the question on that reason alone, and I especially wouldn't down vote the question without providing any explanation of the injection vulnerability. On questions in the php section, I'm starting to work this information into my answer (sourced and modified from here for this) as a standard way to try to dissuade new php coders from exposing their code to such vulnerabilities.
Something similar could probably be worked into responses to other questions, although I avoid using this as my entire answer. Otherwise it's a fairly direct RTFM answer that may not directly help the original poster of the question.
--
Please don't use mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process (see the red box). Instead, you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you care to learn, this is a good PDO tutorial.
--
mysql_real_escape_stringin sight), but I choose to post a strongly-worded answer instead.