Hacker News Reader

It really really sucks that it’s almost 2021 and we still have to try to sneak in a little SQL injection just to see if they know about it...

Ffs is that never going to go away?

View on HN

the only way it could possibly go away for good is database libraries that don’t support dynamic SQL. But you almost always need the flexibility at some point, and SQL is so powerful that taking it off the table is hard to justify.

just use prepared statements instead of string concantenation to build your SQL statements.

Yes, there's lots of ways to fix SQL injection. I'm more surprised that after knowing about this vulnerability for 20+ years, its STILL lost on many developers. You and I pick up on it immediately, but there's (apparently) a lot of developers who think the code is "good enough, works for me" and ship it to production.

So it needs to be asked for in interviews, and if you find it and discuss it you're apparently one of the "better" programmers. The bar for being a passable programmer is literally on the floor.

Absolutely, but most database libraries still allow concatenation.

Reply on news.ycombinator.com