Sine a major goal of SO is to compile the best programming questions and answers on the internet, I'm wondering if there's more we can do to single out and/or correct cases where questions or answers contain exploitable code (see MySQL Select Statement - GROUP BY/Unique which includes an sql injection vulnerability). I always try to point this out to authors, but I tend not to make edits so I don't change "the meaning" of the author.

One approach for this I though of was to create a special flag to be added to questions or answers noting that the included code or advice is unsafe. Alternatively, is it better to follow a hard "edit out" approach in these cases?

2 Answers 2


(For those of us who don't have edit rights)

In the case of your example, I think answering with your own safe code and stating that it is also not vulnerable to SQL injection.

When the vulnerable code is in an answer, post the code in a new answer, and leave a comment pointing to it.


It is probably better to just edit the code and leave a note that you were making it SQL injection safe. Mainly because if we added a flag, some people would ignore it. Better to just make the code safe and risk someone not knowing exactly what its doing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .