Should question, or answers for that matter, with SQL Injection or other security issues be down voted?

I lean towards down voting them, so if in the future someone finds the question, the number of down votes may lead them to question the validity of the question.

  • 13
    Why would you downvote a question containing SQL injection? Wouldn't it be better to just point out the problem? That would be like downvoting someone because their code threw an exception. That's why people come here and ask questions. Jun 18, 2012 at 13:25
  • Voting to close as "not constructive"? Can't we ask valid questions on meta anymore?
    – Matt
    Jun 18, 2012 at 13:25
  • 3
    @Matt I don't see why it's not a valid question. Although I think that the general question here (what's a valid reason to downvote) is a dupe many times over. As we can see from the "Related" sidebar =) Jun 18, 2012 at 13:28
  • 5
    Downvotes are not a code review tool. Except on Code Review...and even then only on answers
    – Ben Brocka
    Jun 18, 2012 at 13:38
  • @John This is one such question where it is extremely tempting to downvote a question because of the presence of SQL injection attacks, since it's so blatantly vulnerable code (not even a mysql_real_escape_string in sight), but I choose to post a strongly-worded answer instead. Jun 19, 2012 at 0:12

2 Answers 2


Downvoting a question containing a SQL injection hardly makes sense. Add a comment highlighting the problem instead - unless it already is the issue that the question is about.

Downvoting an answer that contains a SQL injection is a valid use of your vote IMO, even though it's rarely done. Still, the more important thing to do is to point out the problem in a comment - that is the best warning sign for future generations.

In some cases, it can also be appropriate (and nice) to edit the answer to fix the problem.

  • 5
    My thoughts exactly, +1. The only reason I could think of for downvoting a question with SQL Injection is if, in the question, the author is admitting to knowledge of the vulnerability and saying they don't see the point in fixing it. Even then, I'm kind of on the fence. Jun 18, 2012 at 13:30
  • 4
    @jadarnel yeah, the "I know there are vulnerabilities but I need to get this working urgently" kind, that happens often and I'm on the fence too (seeing as it's their own grave they're digging)
    – Pekka
    Jun 18, 2012 at 13:31
  • @Pekka +1 for phrasing it more succinctly than I did. In relation to php (the language I know best, which is why I reference it) I'm almost tempted to down vote answers where I see people recommending the mysql_* functions because it's so simple to avoid SQL injection with the non-deprecated functions. Jun 18, 2012 at 13:34
  • 2
    @pythonscript yeah. Those functions' time is definitely over, and I notice you are one of those constantly adding comments to that effect. Keep up the good work - it's comments like those that will slowly change the way people do it. even though you won't get many thanks for it. Downvoting mysql_* answers and saying so might cause you more grief and discussions than it may be worth, though :)
    – Pekka
    Jun 18, 2012 at 13:38

Certainly in an answer. It's just a poor answer if it contains an easily preventable vulnerability, but I would also point out the problem in a comment.

However, I wouldn't necessarily down vote the question on that reason alone, and I especially wouldn't down vote the question without providing any explanation of the injection vulnerability. On questions in the php section, I'm starting to work this information into my answer (sourced and modified from here for this) as a standard way to try to dissuade new php coders from exposing their code to such vulnerabilities.

Something similar could probably be worked into responses to other questions, although I avoid using this as my entire answer. Otherwise it's a fairly direct RTFM answer that may not directly help the original poster of the question.


Please don't use mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process (see the red box). Instead, you should learn about prepared statements and use either PDO or MySQLi. If you can't decide which, this article will help you. If you care to learn, this is a good PDO tutorial.



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .