Doc Avid Mornington

Not actually a doctor.

  • 0 Posts
  • 29 Comments
Joined 1 year ago
cake
Cake day: July 5th, 2023

help-circle








  • I’m not sure how including a final semicolon can protect against an injection attack. In fact, the “Bobby Tables” attack specifically adds in a semicolon, to be able to start a new command. If inputs are sanitized, or much better, passed as parameters rather than string concatenated, you should be fine - nothing can be injected, regardless of the semicolon. If you concatenate untrusted strings straight into your query, an injection can be crafted to take advantage, with or without a semicolon.










  • To be fair, it said “an enormous amount of code”, not “your entire app”, but yes, the ability to add unexpected new features or make focused changes without touching more than a minimal amount of existing code is a very good smell metric of code quality. The problem is that for every dev who understands how to program like that, there are at least five, probably more like ten who don’t, which means most of us are working on teams that produce a blend of clean code and, as you say, dog shit, so the feature request that requires stirring up all that shit is out there waiting for us, like it or not. The best we can do, when it hits, is try to at least improve all the shit that we touch in the process. Maybe some of it can become compost, I dunno, the metaphor breaks there, gonna have to refactor the metaphor.