Gab's was a result of a patch they've made on top of Mastodon. Since Mastodon's license required them to share the code, here's a commit that introduced it (https://github.com/d0nk/gab-social/commit/fb3b7545705153022c...). They've since "fixed" the problem by sharing just an archive of the code, and password protecting it with "JesusChristIsKingTrumpWonTheElection").

I find it quite hilarious.

Edit, can I guess that this isn't how to do proper sql parameterized input?

> s.account_id = #{@id}

I don't know ruby at all...

"https://thewebsite.com/the_url?max_id=); DROP TABLE orange_face_paint ; [.. make the remainder valid sql here]"

I would think. Essentially, it allows user-provided input to do anything; it's the most trivial form of SQL injection vulnerability.

Very un-Christian of them to be spreading straight up lies.