Possible Duplicate:
Allow author of accepted answer to delete it in certain circumstances

I gave a quick aswer to a question that, while it works, allowed the potential to have SQL injection attacks.

As the original poster was trying to use string substitution for an UPDATE, and I haven't used that backend (there are some DB backends in Python that use different placeholders) I showed how the string replacement should be done, with a comment that it shouldn't be used in production.

Pretty soon someone gave a better answer, to which I left a link in a comment in my own answer, and was upvoted over mine.

But the OP accepted mine, wich, with justice, warranted a small flood of downvotes. As I couldn't delete my accepted answer, I decided to include the correct answer with further explanation of why not to use the other way.

What this the correct thing to do? Was there anything else I could do?

  • Good work! You should leave a not on the answer explaining that the answer below you still deserves the check. – jjnguy Aug 21 '09 at 15:59
  • 2
    Also, I know jon Skeet has talked about this. He wants to be able to 'give away' the checkmark. – jjnguy Aug 21 '09 at 16:00
  • This is, in fact, an exact duplicate. Almost as exact as they get...neat. – jjnguy Aug 21 '09 at 16:01
  • Jon did the exact same thing you did, if that makes you feel better. – jjnguy Aug 21 '09 at 16:02
  • As matter of fact, it does :) – perbert Aug 21 '09 at 16:07
  • Wow, I am really good at having conversations with myself. pats on back – jjnguy Aug 21 '09 at 16:07
  • Dam you voyager...broke my streak!! – jjnguy Aug 21 '09 at 16:07
  • @jinguy: sorry. Do you want me to change my name to jinguy for today? – perbert Aug 21 '09 at 16:16

Make the accepted answer as correct as possible - that's precisely why SO is editable. If it is correct, it will be upvoted eventually.

  • Bingo! Just fix your answer. – Michael Pryor Aug 21 '09 at 16:02
  • I just felt that I was ripping the other guy ot. – perbert Aug 21 '09 at 16:06

I generally make it known that "This is an example, not a verbatim solution" when I'm dealing with queries that may be susceptible to injections. That way, I'm making it clear that I do not intend my code to be copied/pasted, but rather studied and expanded.

In the past, I've had comments like "Your answer is soooo lame, I can hack that so fast," to which it's quickly pointed out by others "he explicitly stated it's not a working-solution, but a simplified example."


I'd say you did the right thing. The injection risk and your correction are clearly stated and credited. Not much else you can do unless the OP goes in and undoes the accept. Only other thing would be to flag for moderator attention.

Not the answer you're looking for? Browse other questions tagged .