-27

You know that "crazy thing" that many of us say and what Stack is about, right?

  • Stack isn't about writing code.

IMHO, the same thing applies to doing rewrites.

About a question/problem with code:

  • A question is posted, answer(s)/solution(s) given. (If) it fixed it, great, end of story.

This one's mostly in regards to PHP/MySQL.

We see questions that have obvious syntax errors and answers are submitted that actually "fix" their posted code, but then you see most or all of the good/correct answers being downvoted; why is that?

I know, it's probably hard (if not impossible) for anyone to really answer that and to get to the bottom of it. I have my own views on this, but is an entirely different animal that can't be dealt with.

Take for example, and in regards to some PHP/MySQL related questions:

Why would a perfectly good/correct answer be downvoted?

Possible reasons:

  • Because it wasn't rewritten using a (MySQLi) prepared statement?
  • Because it was written in MySQLi_ and not rewritten in PDO?
  • Because it was rewritten using the PDO API but not as a prepared statement?
  • Because it solved the question without using any of the above mentioned?

Take the following Q&A's, where (correct) answers were downvoted. This is only a partial/recent list I've been keeping track of, due to questions being improperly closed and using the wrong duplicate(s):

Edit: The following can only be viewed by 10k+ members, since they voted to delete them. Why? I have no idea.

Edit #2: Consult "Deleted and fetched references edit" below, since the deleted questions are not viewable by members with less than 10k. They too have a right to see them and their voices/votes count just as much as anyone.

Sidenote: I know my PHP/MySQL syntax rather well in order to differentiate between a correct and a wrong answer.

Most or all (technically correct) answers were downvoted and I don't feel that's fair towards those who offered their (free) gracious help.

After all, we're not "paid" for doing this, as rewrites can potentially take a lot of time. If someone wants to rewrite it, great; that's their decision. But downvoting other answers while doing the rewrites seems almost be a case of wanting to take over a tag. It's like being in a relationship where one person believes themselves the only one to be right all of the time.

If the downvoting of perfectly good answers continues and isn't stopped or slowed down, there stands to be (more) members who won't bother helping/contributing anymore, and this I've been told quite a few times by other members (be it asker/answerer) in the distant and the not so distant past; this being a fact, I'm not making this up.

There have been a few really good coders/contributors that I've had the pleasure of knowing. They're either no longer contributing at all and just left, or are no longer contributing to the "php/mysql" sections but elsewhere.

I agree that if a wrong answer was downvoted, it probably deserved it because it was either totally wrong, they missed something important or it didn't answer the question. It's an anonymous vote, which we all know.

Some post a comment under the (wrong) answer, others choose not too; that's their decision and I for one respect it. Many/I don't like it but I "respect" it.

I agree that security is of the utmost importance and they should be "informed" about it; but not by "rewriting" their code nor be downvoted for it.

Some of the question may contain 20, 30+ arrays and doing an entire rewrite with named placeholders, or ? placeholders would take a fair amount of time to rewrite complete with secure code and many of those who answer only want to correct the OP using the same method the OP is using while providing a warning about SQL injection, prepared statements and plain text and/or deprecated hash methods for passwords. "Teach a man to fish", so to speak.

What if the OP doesn't understand what those mean and how to use them/modify them later on, or don't know how to change their DB connection method, and/or class(es) and method(s)? Many are obviously "learning" how to code, doing it step-by-step / baby steps; we were all "there" at one time, so let's not forget where we came from.

That's where (official) manuals and tutorials come in, right? Well, Stack isn't a "tutorial site", it's a place where we help people fix code, or the occasional ones where they're seeking "guidance" on a complex procedure; the latter are asked by both the newbie and "seasoned" coder alike.

If we/I can help in any way to put them on the right track, then I would call that a "step forward", rather than taking "two steps back", as it were.

I'm not here to save the world nor do I want to pass myself off as being a martyr, but I really would like to see some kind of change "for the better" and not "for the worse".

By taking a turn for the worse, we're only sending the wrong message and many stand to either not visit Stack or just decide to stay away.

A quality question not only deserves a quality answer, but a "correct" answer; and a correct answer should not be penalized for it.

There's too much elitism being conveyed and that scares people (shy's them) away/turns them right off. By "people", I mean both questioners and answerers alike. None of us like to be fussed at, especially when we are first learning how to do something.

I'm sure there are some (good, intermediate, fantastic coders) who rather not post answers because they feel they'll get downvoted, and that in itself is because there is a certain amount of disdain for it.

I know people rather well and patterns to tell when I'm right about this.

We are after all, only human; as the expression goes. So let us remain "human" and not become a "machine" and to "stay in touch" with the problem at hand by not potentially creating another.

Just so you know:

Anyone who posts an answer for a question that is related to PHP/MySQL that didn't originally involve a prepared statement, stands to get downvoted for it.


Deleted and fetched references edit:

References from deleted questions that were posted before they were deleted, and since the moderators won't undelete them, I had to fetch and paste them all:

Question:

Reference: https://stackoverflow.com/questions/42436553/column-count-doesnt-match-value-count-but-there-are-6-values-and-6-columns

Column count doesn't match value count, but there are 6 values and 6 columns

I got 6 variables, which are sometimes NULL, but NULL is allowed in my DB. And I got 6 columns. Although PHP is giving me the error:

ERROR: Could not able to execute INSERT INTO anmeldungen (FR_PM, SA_AM, SA_PM, SO_AM, SO_PM, MO_AM) VALUES (', , Tobias Glaus, Tobias Glaus, , '). Column count doesn't match value count at row 1

Aso you can see, there are some empty values, but as I said: NULL is allowed in my DB.

<?php
/* Attempt MySQL server connection. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
$link = mysqli_connect("hostname", "username", "password", "database");

// Check connection
if($link === false){
    die("ERROR: Could not connect. " . mysqli_connect_error());
}

// Escape user inputs for security

$name1 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn1']);
$name2 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn2']);
$name3 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn3']);
$name4 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn4']);
$name5 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn5']);
$name6 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn6']);

// attempt insert query execution
$sql = "INSERT INTO anmeldungen (FR_PM, SA_AM, SA_PM, SO_AM, SO_PM, MO_AM) VALUES ('$name1, $name2, $name3, $name4, $name5, $name6')";

if(mysqli_query($link, $sql)){
    echo "Name ", $name1, " erfolgreich eingetragen. Wir freuen uns auf dich!";
} else{
    echo "ERROR: Could not able to execute $sql. " . mysqli_error($link);
}

// close connection
mysqli_close($link);
?>

So what is my fault?

Answers for it:

1)

Each value must be surrounded by '

$sql = "INSERT INTO anmeldungen 
(FR_PM, SA_AM, SA_PM, SO_AM, SO_PM, MO_AM) 
VALUES 
('$name1', '$name2', '$name3', '$name4', '$name5', '$name6')";

2)

Your query should be like this:

$sql = "INSERT INTO anmeldungen 
(FR_PM,SA_AM,SA_PM,SO_AM,SO_PM,MO_AM) 
VALUES ('$name1','$name2','$name3','$name4','$name5','$name6')";

Your syntax is incorrect.. Refer to this article INSERT QUERY


Question:

Reference: https://stackoverflow.com/questions/42337865/insert-query-not-being-fired

Insert query not being fired

I am creating a registration form that updates the data into the MySQL database. While registration when I click on Register then I see the records not being updated in the database but I successfully move to the successful login page. The code is :

<html>
<head><title>Register a account</title></head>
<body>
<form action= "registerd.php" method = "POST">
        ID: <input type= "text" name = "id">
        <br/>Name: <input type = "text" name = "name">
        <br/>Username: <input type = "text" name = "username">
        <br/>Password: <input type = "password" name = "password">
        <br/>Confirm Password: <input type = "password" name = "repassword">
        <br/><input type="submit" name = "submit" value = "submit"> or <a href="index.php">Login</a>
</form>
</body>
</html>

<?php
session_start();
if(isset($_POST['submit'])){
    echo "inside submit";
    $id = $_POST['id'];
    $name = $_POST['name'];
    $username = $_POST['username'];
    $password = $_POST['password'];
    $repassword = $_POST['repassword'];


    if($password==$repassword){
            $connect = mysqli_connect("localhost","root", "","login") or die("Couldn't connect to database");

            $query = mysqli_query($connect,"INSERT INTO users (id,name,username,password) VALUES ($id,$name,$username,$password)");

            echo "query fired";
    }
}
?>

Please suggest.

Answers given:

1)

$query = mysqli_query($connect,"INSERT INTO users (id,name,username,password) VALUES ($id,$name,$username,$password)");
echo "INSERT INTO users (id,name,username,password) VALUES ('$id','$name','$username','$password')"; //echo your query
die(); //stop yourscript

try to insert this query into SQL directly and you'll see the problem. I've an idea that your $id in set to auto-increment.

2)

you didnt use quotes on strings.

$query = mysqli_query($connect,"INSERT INTO users (id,name,username,password) VALUES ($id,'$name','$username','$password')");

I really really recommend that you use prepared statements instead of this code though, with this you are vulnerable to SQL Injection

Also do you really want to store the actual password in the DB?

edit: since you mentioned in a comment to another answer that your id is auto incremented, leave out the id in your query like so: (you still need to put quotes though ;))

$query = mysqli_query($connect,"INSERT INTO users (name,username,password) VALUES ('$name','$username','$password')");

edit2: if that still doesn't work, echo the error with mysqli_error():

if(!$query = mysqli_query($connect,"INSERT INTO users (name,username,password) VALUES ('$name','$username','$password')")){
    echo 'query failed: '.mysqli_error($connect);
    die();
}

3)

You can try $query = mysqli_query($connect,"INSERT INTO user (name,username,password) VALUES ('".$name."','".$username."','".$password."')"); this this way to insert it. here i'm using id as auto increment column.


Question:

Reference: https://stackoverflow.com/questions/42429767/capture-array-values-from-input-fields-using-php-in-mysqli

capture array values from input fields using php in mysqli

Hello guys i've seen a tutorial from this website HERE by Saran Chamling

Where it is called Capture Array Values from Dynamic input Fields using PHP

so here is the html file

<form method="post" action="collect_vals.php">
<div class="input_fields_wrap">
    <button class="add_field_button">Add More Fields</button>
    <div><input type="text" name="mytext[]"></div>
    <div><input type="text" name="mytext[]"></div>
    <div><input type="text" name="mytext[]"></div>
    <div><input type="text" name="mytext[]"></div>
    <div><input type="text" name="mytext[]"></div>
</div>
</form>

next is the full php code where it will saved the array input fields collect_val.php

<?php
//Open a new connection to the MySQL server
 $mysqli = new mysqli('host','username','password','database_name');

    //Output any connection error
if ($mysqli->connect_error) {
    die('Error : ('. $mysqli->connect_errno .') '. $mysqli->connect_error);
}

$capture_field_vals ="";
if(isset($_POST["mytext"]) && is_array($_POST["mytext"])){
$capture_field_vals = implode(",", $_POST["mytext"]); 
}

 //MySqli Insert Query
$insert_row = $mysqli->query("INSERT INTO table ( captured_fields ) VALUES( $capture_field_vals )");

if($insert_row){
    print 'Success! ID of last inserted record is : ' .$mysqli->insert_id .'<br />';
}
?>

I know hot to insert data but not in array, can someone help me with this? Thank you

Answer given:

The value that you're capturing is a string so change

$insert_row = $mysqli->query("INSERT INTO table ( captured_fields ) VALUES( $capture_field_vals )"); 

to

$insert_row = $mysqli->query("INSERT INTO table ( captured_fields ) VALUES( '$capture_field_vals' )");

just add quote to '$capture_field_vals'.


Question:

Reference: https://stackoverflow.com/questions/18869513/php-insert-into-not-working

PHP Insert Into not Working?

For some reason the php insert into is not working for me and just goes to the die.

<form action="user_create.php" method="post">
   Forename: <input type="text" name="forename"><br>
   Surname: <input type="text" name="surname"><br>
   Username: <input type="text" name="username"><br>
   Password: <input type="text" name="password"><br>
   Email: <input type="text" name="email"><br>
   <input type="submit" value="Create User"><br>
  </form>

And here is my php code:

 $forename = $_POST['forename'];
 $surname = $_POST['surname'];
 $username = $_POST['username'];
 $password = $_POST['password'];
 $email = $_POST['email'];

 $insert = "INSERT INTO users (id, forename, surname, username, password, email)
 VALUES(
 ''
 ,$forename
 ,$surname
 ,$username
 ,$password
 ,$email)";

 echo("$forename");
 echo("$surname");
 echo("$username");
 echo("$password");
 echo("$email");

 mysqli_query($con, $insert) or die ('Error');

 mysqli_close($con);
 ?>

For some reason the code does not complete the mysqli_query, it runs the die code.

Answers given:

1)

Note that your values put iside single quotes ' and are escaped by mysqli_real_escape_string. Consider also apply strip_tags on them to prevent basic xss.

$forename = mysqli_real_escape_string($con, $_POST['forename']); 
$surname  = mysqli_real_escape_string($con, $_POST['surname']);
$username = mysqli_real_escape_string($con, $_POST['username']);
$password = mysqli_real_escape_string($con, $_POST['password']);
$email    = mysqli_real_escape_string($con, $_POST['email']);

$insert = "INSERT INTO users (forename, surname, username, password, email)      
VALUES('$forename','$surname','$username','$password','$email')";

echo("$forename");
echo("$surname");
echo("$username");
echo("$password");
echo("$email");

mysqli_query($con, $insert) or die ('Error');

mysqli_close($con);

Also consider such expression instead of just die('Error')

mysqli_query($con, $insert) or die (mysqli_error());

This will help you to know what's exactly wrong with your query.

2)

You are inserting a string, use quotes around it like this:

 $insert = "INSERT INTO users (id, forename, surname, username, password, email)
 VALUES(
 ''
 ,'$forename'
 ,'$surname'
 ,'$username'
 ,'$password'
 ,'$email')";

You don't need quotes around numbers, but you will need them around strings. Otherwise, what would happen if I entered "bob,hithere" as my username? The poor database would think it was two columns.

Secondly, the way you are inserting has some serious security problems. Tricky folk could easily construct a value that would compromise your database.

This is a good link to a question that will tell you why you should change the way you insert data into your database.

3)

Don't insert a ID by leaving it empty, just don't insert one :)

$forename = $_POST['forename'];
$surname = $_POST['surname'];
$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];

$insert = "INSERT INTO users (forename, surname, username, password, email) VALUES('$forename','$surname','$username','$password','$email')";

echo("$forename");
echo("$surname");
echo("$username");
echo("$password");
echo("$email");

mysqli_query($con, $insert) or die ('Error');

mysqli_close($con);
?>

As you can see, all valid and correct answers that were downvoted because they didn't rewrite them using a prepared statement.

Some of them already included an escaping function, but that didn't seem to satisfy a few elitists.

72
  • 10
    typo questions shouldn't receive answers. Upvoted answers to said questions make them undeletable (by the automated system). downvotes on said answers helps counter that.
    – Kevin B
    Feb 28, 2017 at 16:31
  • 14
    I can. But, I don't need to read it all the way through to know that it's a rant about people's voting behavior. A topic which is discussed on Meta almost daily. Every question and answer pair is its own special little snowflake and doesn't deserve to be downvoted or closed, we get it... Feb 28, 2017 at 16:32
  • 3
    I read your question partially and got the impression that it's just a rant about downvotes. Please correct me if I'm wrong. Or add an introduction to your post, because tl;dr.
    – user247702
    Feb 28, 2017 at 16:33
  • 21
    "Some of the question may contain 20, 30+ arrays" - those questions should be written to provide a [mcve], IMO. Or at least the answer can show a minimal but good practice answer. I don't work in the MySQL/PHP tags, but if someone suggests just "escaping" (usually very, very poorly) values and leaving a SQL Injection Attack in place, I'll happily downvote it: it's a poor answer.
    – Jon Skeet
    Feb 28, 2017 at 16:35
  • 7
    Could the downvotes be in punishment for answering an obvious dupe? I don't have enough PHP to know if it's obvious, but all cited questions are closed as duplicate.
    – user3458
    Feb 28, 2017 at 16:36
  • 5
    Each of your sample questions is a duplicate to the same question, which you hammered (yay!), but they still received an answer. Maybe users are sick of seeing the same question over and over and sick of the same answers over and over. Closing as a duplicate is the correct thing to do. I just wish it could be done faster. I think that'd be more helpful to both the OP and the site in general.
    – Andy Mod
    Feb 28, 2017 at 16:37
  • 8
    @Arkadiy He's specifically called out people posting answers with SQL injection vulnerabilities and getting downvotes for not writing code that doesn't have said vulnerabilities, not people getting downvotes for just "gimming teh codez" to people asking to "gimme teh codez".
    – Servy
    Feb 28, 2017 at 16:39
  • 3
    So you argued that the downvotes are very wrong, but I don't anything justifying what makes those answers useful, unique, that'll help programmers (not the OP) in the future.
    – Tunaki
    Feb 28, 2017 at 16:50
  • 3
    @Andy he's trying to change the system of already existing duplicates already set into place, downvoting the correct answers (I have a very good feeling he does that. I'm so confident about it, that I will stake my reputation on it and my family name on top of that) - so it's just not right. Again; answers that fixes code shouldn't be penalized for it, and the duplicates must conform to the actual problem. Feb 28, 2017 at 16:58
  • 8
    @code11 He's upset that people are downvoting answers with SQL injection vulnerabilities when the questions also have said vulnerabilities, asserting that since the code in the question is problematic it's okay for the code in the answers to be problematic, and that it's ruining the site to downvote said answers because they're "technically correct" answers to the question.
    – Servy
    Feb 28, 2017 at 17:00
  • 3
    But usually, answering crappy questions may leads to downvotes, even if you answer is technically correct. It is possible to polish a turd, but not very likely.
    – yivi
    Feb 28, 2017 at 17:09
  • 9
    @Fred-ii- Just adding a, "here's a link to read more about this" at the end of a highly dangerous action that you know they shouldn't be using isn't really addressing the problem that makes the post not useful. If someone tells you that they've got a fly in their house and they're trying to shoot it with their handgun, but the trigger won't budge, the correct answer is not "your safety is on, turn it off". If you then follow that up with, "here's a link to some info on why using a handgun to kill a fly in your house might not be a great idea" that's still a bad answer.
    – Servy
    Feb 28, 2017 at 17:12
  • 5
    @Fred-ii- Your question was about the appropriateness of downvoting a post. The guidelines for whether or not a post merits downvotes is defined as whether or not the post is useful. Therefore, you post was absolutely about whether or not posts in the situation you've described are useful. The technical correctness of the post is just one factor of many to take into consideration when voting, so your assertion that, in your hypothetical situation, the post is factually accurate, is relevant, but not sufficient to determine the appropriateness of a vote.
    – Servy
    Feb 28, 2017 at 18:03
  • 8
    @Fred-ii- How is that mixing apples and oranges? You want to know why a correct answer would be downvoted. It merits being downvoted if it's not useful. It isn't necessarily useful just because it's "correct". That is answering your question. You personally may want to upvote answers that aren't useful, and I (nor anyone else) unfortunately cannot stop you, but you are going against the site's guidelines by choosing to ignore the usefulness of posts when voting on them.
    – Servy
    Feb 28, 2017 at 18:09
  • 3
    Then..... maybe add the context here? Just like a question on Stack, if I need to "live a mile in your shoes" to get your point... maybe your question isn't precise enough? Include that context..... This is just a super long rant, and I need to go in the comments to realize that you are calling out a SPECIFIC user in the end, not the whole community. And all your comments about "oh... if you only knew"... well.... LET US KNOW, TELL US. Being cryptic about "I know more and this is why my question makes sense" will not help us figure out what you mean....
    – Patrice
    Mar 9, 2017 at 16:55

2 Answers 2

42

Posts are not evaluated based on on whether they are "correct" or "wrong", but rather on whether they are useful or not useful. Just because an answer does not contain technically incorrect statements doesn't mean that it's a useful answer. (To pick an entirely arbitrary example, if an answer contains significant security vulnerabilities it's quite likely not useful, even if it contains no technically incorrect statements.)

Yes, people posting answers are doing so as volunteers; providing content for free of their own free will. That's great. But that doesn't mean that people aren't allowed to downvote their answers if they post answers that aren't useful. Users aren't obligated to upvote your answers just because you're posting them for free. Answers are voted on based on their quality. If you post answers that are of low quality, we want them to get downvoted, even if you're providing them for free. You're not actually helping the community by providing low quality answers, even if you're doing it for free. If you want to help out and post answers (which is great) you need to make sure that they're quality answers.

If you feel that posting a quality answer, that don't contain major security vulnerabilities, or have other types of significant problems, is more work than you're willing to provide, then that's fine. As was mentioned before, SO is a place for people to willingly volunteer their time. If you don't want to spend the time to write a quality answer you are by no means obligated to do so. You certainly don't have to entirely re-write someone else's steaming pile of code. But what we don't want is people posting bad answers to bad questions. That's just making the problem worse.

22
  • 2
    What if the answer being downvoted is legit? In other words, it answers the question correctly but along the lines of the what the OP posted where the OP has a potential for something like a SQL injection attack (variable concatenation, for instance) but the answer or comments contain a warning about the potential? Feb 28, 2017 at 16:42
  • 1
    Then the answer can be correct, useful, and not useful all at the same time. but it isn't high quality.
    – Kevin B
    Feb 28, 2017 at 16:43
  • Temporal answers @KevinB? I love it! Feb 28, 2017 at 16:44
  • 1
    @JayBlanchard Like I said, people vote on answers based on whether or not they think the answers are useful. If someone thinks that an answer isn't useful because of it providing a solution that is full of major security vulnerabilities, then it's entirely appropriate for them to downvote said answer. That the answer isn't factually wrong doesn't mean it isn't "not useful". You are of course free to disagree with that person and may feel that code with major security vulnerabilities is perfectly fine, and you are allowed to upvote said posts, despite how cruel of an action that is.
    – Servy
    Feb 28, 2017 at 16:44
  • 1
    "To pick an entirely arbitrary example, if an answer contains significant security vulnerabilities it's quite likely not useful, even if it contains no technically incorrect statements" yet we've seen questions and answer that promote the use of such vulnerabilities being upvoted le sigh
    – Braiam
    Feb 28, 2017 at 16:44
  • 2
    Crap - then some of my answers are "low quality" because I didn't rewrite the code with prepared statements and explain the security vulnerabilities. I just provided the warning messages with links to proper resources. Feb 28, 2017 at 16:46
  • 2
    @JayBlanchard Yeah, let me go downvote them all! lol You know I'm joking of course ;-) Feb 28, 2017 at 16:46
  • 7
    @JayBlanchard: If the warnings are really prominent, I think that's okay. I've seen far too many answers that take that approach but leave the warnings pretty much obscured in the middle of the 7th paragraph... and that kind of answer I'd still downvote, on the grounds that too many people will copy/paste the vulnerable code without reading the rest of the description. I would always put the warnings before the vulnerable code, usually in bold. (And I'm hoping you do too :)
    – Jon Skeet
    Feb 28, 2017 at 16:50
  • 17
    @Fred-ii- That is entirely correct. It's extremely hard to provide a useful answer to an awful question. Many questions are so bad that it's impossible to provide a useful answer to them. That's why we have systems such as closure in place to prevent people from posting answers to such questions, although these systems are indeed imperfect in that people can often get answers in before the question can be closed, providing answers that aren't useful. Conversely, great questions enable great answers, and make good answers better.
    – Servy
    Feb 28, 2017 at 16:54
  • 4
    @JonSkeet "If the warnings are really prominent" the problem is that most of the time, the people reading the answers has tunnel vision looking for the code snippet, which then go to production verbatim. So, one has to wonder, do the people heed the "warning" and which of them would be more useful in the long term? My take is to not include copy-n-pastable code with vulnerabilities.
    – Braiam
    Feb 28, 2017 at 17:08
  • 1
    @Braiam: I generally don't either - can't remember when I have done - but I'm less likely to downvote an answer that does if the warning is prominent.
    – Jon Skeet
    Feb 28, 2017 at 17:13
  • 2
    @Fred-ii- The statement applies to all posts, not just questions. I've already told you, you don't necessarily need to re-write every single post to provide a quality answer; there are lots of ways to provide quality answers to questions without re-writing all of their code for them. But if you're posting answers with major security vulnerabilities in them, you're likely to attract entirely merited downvotes. You personally may think that it's okay to provide such answers, but many experts feel that they are not helpful, and vote accordingly, and we thank them for it.
    – Servy
    Feb 28, 2017 at 18:07
  • 1
    @Servy "But if you're posting answers with major security vulnerabilities in them, you're likely to attract entirely merited downvotes." - That's the thing but I do agree with you on this 100%. However, and take for example: An answer given contains mysqli_real_escape_string() which is supposed to help safeguard against an (My)SQL injection, but they didn't rewrite it to use a "prepared statement" in either using the MySQLi_ or PDO APIs; that's where it also starts and they get downvoted for it, I've seen it happen too many times and we're to do a rewrite because of someone not agreeing? Feb 28, 2017 at 18:26
  • 1
    @Fred-ii- You agree with that statement 100%, and yet you've posted a whole bunch of answers with major security vulnerabilities and said that the downvotes on them are entirely unacceptable and nobody should be downvoting those answers. But anyway, having major security vulnerabilities is one thing that can make an answer not useful. Someone may feel that other problems with an answer may be significant enough to make it not useful. You may choose to disagree, and you might think that the answer is useful anyway; you're allowed to do that.
    – Servy
    Feb 28, 2017 at 18:47
  • 1
    @Accountantم No, that's precisely who it's not useful for. Someone who doesn't realize the problems with the code, and doesn't understand how to properly avoid them, is exactly the person who's going to be most harmed by reading the answer. They're someone who might actually end up using the code in a program, which would be a major problem. I also reject the validity of the statement that it's fixing the broken code. It's producing code that's, even more broken, but in ways that's much harder to realize how and why. That's worse, not better.
    – Servy
    Apr 3, 2017 at 13:10
3

"Usefulness" is relative term - if the question already has good canonical answer (usually close-able as duplicate) it means for new answers to be "useful" they need at least match quality of the canonical answer.

I believe downvotes on questions that are significantly worse than known canonical answer are well deserved and promotes desired behavior - closing duplicates questions as duplicates instead of providing multiple half-backed answers.

To particular concerns:

  • SO is not "fix my code" service, if OP can't be bothered to provide minimal sample - it is perfectly fine to close question and move on, there is no need to answer. It also has negative effect on SO as the same people could have provided answers to better questions instead.
  • Providing an answer that is known to have issues and not informing users of the issues is disservice to community and OP. Such code will be copy-pasted into critical systems that handle your payments and leave them vulnerable/unstable.

Not the answer you're looking for? Browse other questions tagged .