How *NOT* To Do A Password Field

Re:How *NOT* To Do A Password Field by krapp on Saturday April 12, 2014 @06:23PM (#7579433)

I'd bet that patterns like

    $db->execute("INSERT INTO USERACCOUNTS ('username','password') VALUES ('".$_POST['username']."','".$_POST['password']."')");

are more common than anyone wants to believe.

[ Parent | on HN ]

Re:How *NOT* To Do A Password Field by SimHacker on Saturday April 12, 2014 @06:38PM (#7579478)

The PHP manual pages are full of user comments with helpful suggestions just like that, which incompetent programmers copy and paste into production systems. But I think of it as a good thing, an instance of evolution in action, because banks that hire such stupid programmers deserve to have all their money stolen from them.

[ Parent | on HN ]