Hacker News Reader

Comment by noduerme | Hacker News Reader

How is sql injection even still a thing? It's completely trivial to escape and validate user-supplied values with any modern library. It's straight up coding malpractice not to. Aside from attacking badly written forms on sites that haven't been updated since the early 2010s, is there really a large attack surface against modern libraries in the wild?

View on HN

Same goes for memory safety in programming languages, constant streamof RCE vulnerabilities in browsers, the ongoing climate disaster, etc. <10% of people mak a lot of noise and worry about stuff that is on fire, the silent majority is more yolo.

I'd say that memory safety is still a very much unsolved problem if you're working close to the metal. It's not a solved problem with tons of well-worn routes in every language like escaping database queries is. As much as I love hacking in C++ to try to understand how to manage my own memory and write everything back to C-style pointers, as code golf, I would never put that shit into production without using well-tested libraries to do what I was trying to do.

Memory management and security is far more complicated a problem than showing a first year intern how to use escaping / binding and never concat strings into a query.

As long as there is string concatenation and SQL libs accept queries as a string there will be SQL injections.

How does someone learn SQL these days and go about getting a job doing it, without having it drilled into them that you must never concatenate strings and stick them in a raw query? Isn't anyone who's capable of learning SQL capable of understanding this?

straight up coding malpractice is rampant

Nobody was ever fired for coding malpractice but many for not hitting their targets.

It was pretty easy ten years ago too, but somehow it remains a problem.

Reply on news.ycombinator.com