Hacker News Reader

You would be suprised... There are startups out there who say "we don't care about an attack we're too small... we're going to write all of our sql by hand."

View on HN

Just because they "write all of [their] sql by hand" doesn't mean they will be vulnerable to an attack as simple as this. This is just pure and unmitigated incompetence.

Yes. Preventing SQL injection attacks is very, very easy. To have something like that in your code in 2015 is inexcusable.

It's not just startups. The stuff I've seen at some very large companies would make you cringe.

As a colleague developer of mine says: I don't want any of my personal information on the internet because I know how developers think.

Sigh.

Reply on news.ycombinator.com