In addition, this is the year 2009. SQL INJECTION by a company this big? Thats rather sad.
My final project in class gets and instant 0/100 (40% of the grade) if SQL injection was possible...
My final project in class gets and instant 0/100 (40% of the grade) if SQL injection was possible...
The average web service has a complexity far greater than any college course project. SQL injections can be mitigated using the correct tools and methodology, but things like this (and buffer overflows) will continue to exist. Such is the nature of things.
There's "oh man, this one variable isn't sanitized", which is a bad, but understandable mistake.
Then there's "oh man, we don't encrypt our passwords AT ALL", which really belongs in the realm of mistakes made by 15 year-olds.
No seriously, the last time I made that mistake was when I was 15.
(So is not using a modern database abstraction library. Even PHP has them these days!)
SQL Injection is very very common. I've worked on sites that never sanitize anything.