News for hackers. Stuff that matters.

A comment on “I've had to relearn coding to get through the new interviews”. Parent comment

Re:“I've had to relearn coding to get through the new interv... by alltakendamned on Friday December 04, 2020 @04:00AM (#25300385)
just use prepared statements instead of string concantenation to build your SQL statements.
[ Parent | on HN ]
Re:“I've had to relearn coding to get through the new interv... by SamuelAdams on Friday December 04, 2020 @10:39AM (#25303449)
Yes, there's lots of ways to fix SQL injection. I'm more surprised that after knowing about this vulnerability for 20+ years, its STILL lost on many developers. You and I pick up on it immediately, but there's (apparently) a lot of developers who think the code is "good enough, works for me" and ship it to production.

So it needs to be asked for in interviews, and if you find it and discuss it you're apparently one of the "better" programmers. The bar for being a passable programmer is literally on the floor.

[ Parent | on HN ]
Re:“I've had to relearn coding to get through the new interv... by jolux on Friday December 04, 2020 @11:07AM (#25303867)
Absolutely, but most database libraries still allow concatenation.
[ Parent | on HN ]