I'm curious what the community thinks of inserting public service messages as comments when analysis shows they might be warranted.
I ran across Firefox does not insert data in MySQL database on occassion, and it clearly suffers an injection. Based on the tags, the MySQL code, and the lack of both PHP Data Objects and MySQLi bind_param
, its fairly evident its the case.
As a security guy, I would love to see a Stack Overflow Bot (SOB) insert a message similar to:
This is Stack Overflow's SOB. Your PHP and MySQL code could be subject to injection based on an analysis of the code you presented. You should visit How can I prevent SQL-injection in PHP? to ensure its not the case.
SQL Injection consistently makes the OWASP Top 10, and this is an opportunity for Stack Overflow to make a real difference. Every programmer who triggered the bot would get a message educating them about it.
Stack Overflow already performs analysis on posts, so there's nothing ground breaking about it. In this case, the twist seems to be to look for both something and the lack of something else.
Also, by inserting the comment on "at risk" code, those who copy and paste it might be warned about blindly doing so. Using code you don't fully understand is a lot like password reuse. We know it should not be done, but it happens more frequently than it should.
I understand there are some downsides, but the upsides could have huge payoffs. At minimum, folks like you or I (and our families) end up in these systems, so maybe we would be at less risk than otherwise.
What does the community think?
Your PHP and MySQL code could be subject to injection based on an analysis of the code you presented. You should immediately stop writing code in such a horrible language against such a terrible database