11

My simple mind can't come to grips with the plethora of code snippets that get posted which are prone to SQL injection, yet here we are.

Is it considered a service to the community to point this fact out to those who post these? That is, is it appropriate to comment on a post indicating that it's prone to SQL injection?

I'm not talking about whether or not to downvote posts with vulnerable code, or catching it as a hot item, or wondering what to do when I don't feel like answering with non-vulnerable code. I'm wondering about repeatedly leaving a civil and informative comment indicating the vulnerability, specific to SQL injection.

It seems to me that there is still enough ignorance of SQL injection to make commenting on it worthwhile if the poster shows no indication of knowing that it's a bad thing. But I don't want to be that guy that just sits there whining that your code is vulnerable.

Improve this question
5
  • Yes... it's always important to do so. It's a sure-fire way to get the pundit badge as well...
    – ben is uǝq backwards
    Jan 24, 2013 at 19:23
  • I like how the PHP mysql_* even has something akin to a whole FAQ post about it, because it's so widely (and insecurely) used. Though not directly connected to SQL injection as such, that issue is often another fault of code that uses mysql_*.
    – J. Steen
    Jan 24, 2013 at 19:26
  • This post should be migrated to meta.SO
    – faintsignal
    Jul 19, 2014 at 18:31
  • @faintsignal why? there are other sites that deal with programming
    – psubsee2003
    Jul 19, 2014 at 23:05
  • @psubsee2003 True, but in this instance the discussion seems to be centred around SO.
    – faintsignal
    Jul 20, 2014 at 0:38

2 Answers 2

Reset to default
17

Of course it is appropriate.

Whenever you see something dangerous/stupid in posted code you should point it out, even if it is not the thrust of the question.

It doesn't matter if you choose to do it in an answer (as an aside) or as a comment (to either a question or an answer).

When I see a question that has code that is clearly open to SQL Injection, I comment on it.

The maxim of Stack Overflow is "Make the Internet a better place" - pointing out SQL Injection is just a part of that.

We don't only answer questions - we try to educate and explain and make better developers.

Improve this answer
2
  • 4
    Agreed. I would add: Don't just say "This is vulnerable"; explain the vulnerability; if possible give an example exploit. In my opinion the best way to learn about and understand these and other vulnerabilities is seeing how they can be exploited.
    – balpha StaffMod
    Jan 24, 2013 at 19:30
  • Good, that is what I was hoping. Thanks!
    – squillman
    Jan 25, 2013 at 13:07
2

Yes it is. Because it still is a big problem.

Maybe add a self answered question about SQL injection. So there is a resource that can be used to link to.

Improve this answer
1
  • 4
    Because there are no existing resources on SO that discuss what SQL injection is...
    – Servy
    Jan 24, 2013 at 20:14

Not the answer you're looking for? Browse other questions tagged .