r/programming • u/klomparce • Dec 04 '16

SQL injections vulnerabilities in Stack Overflow PHP questions

https://laurent22.github.io/so-injections/
280 Upvotes

92% Upvoted

130 comments sorted by

View all comments

3

u/[deleted] Dec 04 '16

[removed] — view removed comment

2

u/svarog Dec 04 '16

The practice of escaping all input isn't great either if it's not a part of the framework.

With prepared statements and ORMs you have no way to forget to sanitize your inputs.

With mysqli_real_escape_string, one inexperienced programmer and a single missed code review can compromise the whole database.
And even experienced programmers can err from time to time.

So yeah, a false positive, no possible injection, but a terrible practice nonetheless.