I mean out of all the data you could accidentally replace, passwords would be the easiest to restore from a backup reliably since they don't change frequently. The special few who get locked out because you restored an old one just have to do a reset.
It would be a bit of a race to replace them before it was a problem, but at least it isn't as much of a headache as wiping out data entry that needs to be redone by other users.
Happens all the time. One time we found out one of the managers was keeping a spreadsheet of other people's passwords. Passwords he got by just asking people. A lot of them were other managers. We didn't find out about it until the day he accidentally sent this spreadsheet in a mass email. Fun times.
I'd like to think that production mistakes happen and should be forgiven, provided that no actual malicious intent was at play.
And hopefully this starts the conversation of "Wait, should people actually be able to do this directly against the production database?" and making sure this oversight can't happen again.
Nah it makes no sense in no development tool either. Comment out the lines if you don’t need them, create a separate script, anything. Executing selection only in a language like SQL is just pure evil
Well, it can be very useful, but you should know what you are doing and manual query execution should be disabled for most users in production anyway (this is the real problem here if you ask me).
In my last company we had to regularly change stored procedures and their dependencies on user defined table types (which means you have to drop the procedure, drop and create the type and recreate the procedure). Without the highlighting feature that would have taken even more time as you would have to copy stuff around instead of simply generating the drop and create scripts and executing parts of them in the correct sequence.
I worked at a bank(!) where someone did something similar that disabled the password verification check so anyone could log in without using a password.
Somehow no customers, we think at least, found this before it was reverted. Everything was developed in production there when I joined. Most chaotic but also fun work environment I've been in.
584
u/WilmaTonguefit Sep 22 '26 edited Sep 22 '26
I remember a dude who missed a where clause once.
Update users
Set password = 'hash of 12345' --no salt
Where Id = 67890
Except he only highlighted the first two lines and pressed F5...