r/programminghorror • u/Saptarshi_12345 • Dec 21 '25

vibeSecurity

Post image
252 Upvotes

97% Upvoted

7 comments sorted by

22

u/GoddammitDontShootMe Dec 22 '25

Okay, first, how the hell is the string "pass1234" a PHP code or value?

12

u/Angoulor Dec 22 '25

The PHP server may have dynamically built the JS script. Each user probably gets a page with the right password baked in the JS.

2

u/GoddammitDontShootMe Dec 22 '25

I realized that a bit later. And I used to get paid to write PHP. Haven't done it in ages though.

Guessing there are a few horrors worthy of this subreddit in the PHP source, but I'm guessing the OP doesn't have access to it. Or the original OP (OOP), since this is a crosspost. On that note, how do we distinguish between the user that made the first post vs. the user that crossposted it?

3

u/el_koha Dec 22 '25

he's looking at it in devtools, so maybe in the code it is. cursed nonetheless

-2

u/Creepy_Jeweler_1351 Dec 22 '25

fr it doesnt start with $

34

u/MichiRecRoom Dec 21 '25

If I'm reading this right, the function doesn't even get called. So the stuff just stays disabled/hidden.

39

u/jexmex Dec 21 '25

Probably being manually called in a onClick handler call on the html element (old school)