Skip to main content
31 events
when toggle format what by license comment
Mar 10, 2018 at 1:12 comment added jpmc26 By the way, this is the question you should've gotten linked to. The top, accepted answer is the one you want, but note it has 113 answers, not 28.
Feb 27, 2018 at 15:11 comment added WGroleau That's not helpful either. 'Bye.
Feb 27, 2018 at 13:50 comment added user1228 I am helping. PHP is a gutter language, a language of last resort. If you see someone wallowing in the gutter and they don't realize they're in the gutter, do you just walk by? No. That would be wrong. You help, by pointing and laughing at them. Maybe they realize why, and go take a shower. Or maybe they start throwing offal at you. Either way, :/
Feb 27, 2018 at 11:38 comment added WGroleau @Will: You're not helping. What do you suggest, perl?
Feb 27, 2018 at 11:37 comment added WGroleau As I hinted elswhere, I don't need someone to teach me what SQL injection is. The question, again, was whether I could trust what some places said was the solution in PHP. And the answer I got was "Absolutely not ... yes it is ... no it's not." And as I also said, the bad answers may have gotten downvotes, but their net score was positive and very large.
Feb 27, 2018 at 10:06 comment added Mr Heelis now, if I call this page.php?name='; DROP TABLE bobbin; it will destroy the database, on the 1st call also I can do something cleverer like this page.php?name='; SELECT password as real_name FROM bobbin; as you can see this will return the passwords as real_name and print them out. So the "old" way of fixing this was to disallow things like apostrophes and escape them with a slash. (EG: ' becomes \' etc) However there are complex rules you can use to use non ansi character sets to effectively escape out of the escapes so the prepared SQL method has been adopted.
Feb 27, 2018 at 10:05 comment added Mr Heelis you've discovered most people on Stack Overflow don't know a damn thing about computers they just cut and paste the same nonsense expecting it to stick.. to understand the issue behind SQL injection, this is a example of SQL injection (assume this is an open source piece of code) UPDATE bobbin SET main_date=now() WHERE name='".$_GET['name']."'; SELECT real_name FROM bobbin WHERE name='".$_GET['name']."';
Feb 27, 2018 at 7:34 comment added Cristik Contradictory answers means one is good one is bad, the bad answers should've got downvotes so it should not be hard to choose the valuable ones.
Feb 26, 2018 at 20:54 answer added Scott Mermelstein timeline score: 8
Feb 26, 2018 at 18:17 comment added user1228 Also, the folks in any random PHP chat may be willing to go help straighten out the answers on that question if informed of this situation...
Feb 26, 2018 at 18:17 answer added taswyn timeline score: 15
Feb 26, 2018 at 18:14 comment added user1228 The solution in these cases is always trivial... Don't use PHP.
Feb 26, 2018 at 17:53 comment added ImportanceOfBeingErnest Be reminded that questions on SO should have a clear problem description. It's clear that if you don't include such problem in the question, it will be quickly closed. So it appears that here the problem comes from reading other answers and not understanding how they answer another question. If the question you ask explains why those other answers are confusing/contradictory/no help for you, your question should not be closed as duplicate. (Actually this meta question explains part of this quite well, so this is what would also be needed in the SO question.)
Feb 26, 2018 at 17:31 comment added WGroleau Oops, thought I put that.
Feb 26, 2018 at 17:25 answer added Dzyann timeline score: 1
Feb 26, 2018 at 17:15 comment added takendarkk I would like the read the question with 28 contradictory answers. Can we get a link please?
Feb 26, 2018 at 15:58 history edited WGroleau CC BY-SA 3.0
added 577 characters in body
Feb 26, 2018 at 15:33 comment added jpmc26 @WGroleau It is not at all clear which of your comments replies to which of other people's comments. When responding to a particular person, please make sure you indicate this with the @ syntax. (This also generates a notification for the target.) Please link the question as Clonkex requested.
Feb 26, 2018 at 4:51 answer added Hogan timeline score: 11
Feb 26, 2018 at 0:04 comment added WGroleau If you ask the same question, you probably get the same answers. But what if your question is not really a duplicate? I think the blurb is something like “this question already has your answer.” Yes, it probably does, but it also has a lot of wrong answers and a lot of unrelated stuff to add to my confusion. Perhaps after three years of retirement, my evaluation skills are rusty, but I’m not stupid. For thirty years, colleagues brought software questions to me. But PHP and MySQL didn’t happen to be part of my professional activities.
Feb 25, 2018 at 23:37 comment added WGroleau It’s not the first time I’ve seen contradictions, nor the first time I’ve seen wrong answers upvoted. In this case, I may not know which answers are wrong, but it’s obvious they can’t all be correct. Especially not the ones advising an API that no longer exists.
Feb 25, 2018 at 22:32 comment added Clonkex Could you link the question with the contradictory answers? I'd like to get a feel for what kind of experience you're having.
Feb 24, 2018 at 13:41 history edited jscs CC BY-SA 3.0
added 11 characters in body; edited title
Feb 24, 2018 at 13:39 comment added jscs How are you supposed to evaluate an answer even when there isn't another contradictory answer? I'm also not sure what being a "newbie" has to do with it...
Feb 24, 2018 at 13:11 comment added WGroleau Maybe I should just write a stored procedure to do all the work and only let PHP pass the parameter. Three lines of SQL and three lines of PHP vs. one line of SQL and a jungle of PHP. Or maybe I should just drop the notion of sharing something I did for personal use. SQL injection is irrelevant when the developer is the only user.
Feb 24, 2018 at 13:06 comment added WGroleau Exactly. I am all for empirically evaluating an answer/suggestion when it is possible, but if I code according to one of them and my DB doesn't get trashed, that does NOT prove it's an effective way to prevent SQL injection. And after thirty years in software engineering (five of them in SQL), and fixing more bugs by REMOVING code than by adding it, it's hard to believe that it really requires a hundred lines of PHP to pull a single record from a two-column table.
Feb 24, 2018 at 12:44 comment added Daniel Pryden It may be worth noting that SQL injection in PHP is a bit of a special case, in that it's a class of problems frequently encountered by newbies but which has extremely complex and subtle security implications, and therefore understanding the mechanisms involved is actually very important for correctness. In addition, both the PHP language and much of the PHP community downplay the dangers and make the easiest solution an insecure one, and the correct solution comparatively difficult. The OP didn't know what a minefield they were stepping into, which probably exacerbated the situation.
Feb 24, 2018 at 12:13 answer added BDL timeline score: 12
Feb 24, 2018 at 11:43 comment added rene How is a person [...] supposed to evaluate answers ... try them? That can be awesome research that you'll need when you ask a new question about one of the answers you tried.
Feb 24, 2018 at 11:30 comment added BDL Wouldn't you get the same answers if you reask the same question? We would then just have two questions with contradicting answers instead of one. I'm not entirely sure what exactly you ask about here: Yes, it is suboptimal if there are contradicting answers. But what exactly do you expect us to do/discuss?
Feb 24, 2018 at 11:12 history asked WGroleau CC BY-SA 3.0