36

I needed to do something extremely simple with PHP/mySQL. Tutorials seemed a little too simple, and also were doing something different.

Started a Stack Overflow question, read about a half-dozen "may already have your answer" questions (none of which helped). Posted the question, and literally within ten seconds was downvoted, and told it was a duplicate (of one I hadn't seen), and asked "why are you mixing APIs?"

Looked at the supposed duplicate, and it indeed seemed like it would help. So I deleted my (assumed to be) unnecessary question, and proceeded to study the other.

What a disaster! It had 28 answers, contradicting each other and most so full of information about things that were not asked, that it was difficult to understand them. And if I had enough knowledge about the topic to figure out which (if any) of the contradictions were correct, I would not have needed to ask the question.

Now, I don't know the solution to this problem, but now that I have (from a different source) code that works, if I ask about SQL injection, I will be directed to this same useless pile of contradictions.

I understand (and generally agree) about avoiding duplication, but if a beginner on a topic wants to ask a simple question, what good does it do to bury him in everything distantly related to the topic? Or to redirect him to wrong answers?

My questions was "Will 'real_escape' really escape SQL injection?" The simple answer would be "No, it can't because it no longer exists." The offered "duplicate" does indeed say that, if you look hard enough. But it also contains answers that say "It's what you must use" and answers that go into detail about not using it with integers (irrelevant to my varchar application), other answers that say you shouldn't use it because it fails to prevent some fairly simple exploits, etc., etc. And and contradictory answers have positive scores of three and four digits.

How is a person who does not know something supposed to evaluate answers offered when they contradict each other?

23
  • 9
    Wouldn't you get the same answers if you reask the same question? We would then just have two questions with contradicting answers instead of one. I'm not entirely sure what exactly you ask about here: Yes, it is suboptimal if there are contradicting answers. But what exactly do you expect us to do/discuss?
    – BDL
    Commented Feb 24, 2018 at 11:30
  • 9
    How is a person [...] supposed to evaluate answers ... try them? That can be awesome research that you'll need when you ask a new question about one of the answers you tried.
    – rene
    Commented Feb 24, 2018 at 11:43
  • 10
    It may be worth noting that SQL injection in PHP is a bit of a special case, in that it's a class of problems frequently encountered by newbies but which has extremely complex and subtle security implications, and therefore understanding the mechanisms involved is actually very important for correctness. In addition, both the PHP language and much of the PHP community downplay the dangers and make the easiest solution an insecure one, and the correct solution comparatively difficult. The OP didn't know what a minefield they were stepping into, which probably exacerbated the situation. Commented Feb 24, 2018 at 12:44
  • 9
    Exactly. I am all for empirically evaluating an answer/suggestion when it is possible, but if I code according to one of them and my DB doesn't get trashed, that does NOT prove it's an effective way to prevent SQL injection. And after thirty years in software engineering (five of them in SQL), and fixing more bugs by REMOVING code than by adding it, it's hard to believe that it really requires a hundred lines of PHP to pull a single record from a two-column table.
    – WGroleau
    Commented Feb 24, 2018 at 13:06
  • 1
    Maybe I should just write a stored procedure to do all the work and only let PHP pass the parameter. Three lines of SQL and three lines of PHP vs. one line of SQL and a jungle of PHP. Or maybe I should just drop the notion of sharing something I did for personal use. SQL injection is irrelevant when the developer is the only user.
    – WGroleau
    Commented Feb 24, 2018 at 13:11
  • 1
    How are you supposed to evaluate an answer even when there isn't another contradictory answer? I'm also not sure what being a "newbie" has to do with it...
    – jscs
    Commented Feb 24, 2018 at 13:39
  • 9
    Could you link the question with the contradictory answers? I'd like to get a feel for what kind of experience you're having.
    – Clonkex
    Commented Feb 25, 2018 at 22:32
  • It’s not the first time I’ve seen contradictions, nor the first time I’ve seen wrong answers upvoted. In this case, I may not know which answers are wrong, but it’s obvious they can’t all be correct. Especially not the ones advising an API that no longer exists.
    – WGroleau
    Commented Feb 25, 2018 at 23:37
  • If you ask the same question, you probably get the same answers. But what if your question is not really a duplicate? I think the blurb is something like “this question already has your answer.” Yes, it probably does, but it also has a lot of wrong answers and a lot of unrelated stuff to add to my confusion. Perhaps after three years of retirement, my evaluation skills are rusty, but I’m not stupid. For thirty years, colleagues brought software questions to me. But PHP and MySQL didn’t happen to be part of my professional activities.
    – WGroleau
    Commented Feb 26, 2018 at 0:04
  • 3
    @WGroleau It is not at all clear which of your comments replies to which of other people's comments. When responding to a particular person, please make sure you indicate this with the @ syntax. (This also generates a notification for the target.) Please link the question as Clonkex requested.
    – jpmc26
    Commented Feb 26, 2018 at 15:33
  • 4
    I would like the read the question with 28 contradictory answers. Can we get a link please?
    – takendarkk
    Commented Feb 26, 2018 at 17:15
  • 5
    The solution in these cases is always trivial... Don't use PHP.
    – user1228
    Commented Feb 26, 2018 at 18:14
  • 2
    Also, the folks in any random PHP chat may be willing to go help straighten out the answers on that question if informed of this situation...
    – user1228
    Commented Feb 26, 2018 at 18:17
  • 1
    Contradictory answers means one is good one is bad, the bad answers should've got downvotes so it should not be hard to choose the valuable ones.
    – Cristik
    Commented Feb 27, 2018 at 7:34
  • 1
    I am helping. PHP is a gutter language, a language of last resort. If you see someone wallowing in the gutter and they don't realize they're in the gutter, do you just walk by? No. That would be wrong. You help, by pointing and laughing at them. Maybe they realize why, and go take a shower. Or maybe they start throwing offal at you. Either way, :/
    – user1228
    Commented Feb 27, 2018 at 13:50

5 Answers 5

15

What a disaster! It had 28 answers, contradicting each other and most so full of information about things that were not asked, that it was difficult to understand them. And if I had enough knowledge about the topic to figure out which (if any) of the contradictions were correct, I would not have needed to ask the question.

Frequently, there are a small set of reasons this occurs:

  1. Imprecise question on a topic that actually has nuance and multiple answers that vary in appropriateness and correctness based on specific context.
  2. Question that confuses terms in such a way that it could be asking multiple different things, or where the question text is actually fundamentally different from the question title.
  3. Questions that actually cover multiple topics at once, or have severe topic crossover, or are better contextualized with a different approach than the one they've been placed in by how the question was asked.
  4. Topics where the best answer has evolved over time.
  5. Topics where there is a large difference between "good enough" answers, "best" answers, and "deceptively decent but fundamentally not ok" answers, and the differences are all highly technical.

"How is a person who does not know something supposed to evaluate answers offered when they contradict each other?"

Ultimately, Stack Overflow will never be a perfect resource when you're simply coming here for "just tell me what to do." That's not the intent it's meant to fulfill, and if you're not willing to do more research on a topic that receives a number of seemingly conflicting and technical answers, then it's generally a warning sign that you either need to find something else that just tells you what to do, or consider having someone else do that specific task for you.*

*This is not me saying I don't think you're capable of learning it. But rather, that a lack of desire to dig into a topic is usually a good signal that it's not something you're interested in learning to the depth required for that topic. It happens to me too, at which point I find ways to delegate it or contract it out, or slog through it knowing I probably am not doing as good a job as would be optimal and accept the related risks and costs.

It's ok to not be an expert at everything and not want to be one (or simply accepting that there just isn't time in the day to be one). But one also has to be realistic in those circumstances that if she isn't an expert, she isn't going to do as well (and/or work as quickly) as someone who is an expert.

To an extent, the best answers do generally rise to the top in terms of voting (and on complex topics where the question itself lacked nuance, the selected answer can prove to be misleading, even). Any time when there are non trivial differences between highly voted answers from the same time period, or where some of them are not merely extended clarifications/extra details of each other, it is a good signal that there are actual valid reasons for the arising ambiguity and that the topic is simply going to require more and deeper research.


Digging in more specifically, based on your comments on other answers, you seem to be asking PHP + SQL injection questions.

Several PHP tutorials failed to mention SQL injection. I spent years doing SQL, but injection was not a risk in my environment, and PHP wasn't used.

I'm not going to try to find specifically what question you landed on that's confusing you, but I would like to lightly address that confusion, in the context of what I've been trying to say here more generally.

At issue is that there is no entirely perfect bullet in the broader web security context simply by following some set of steps specific to PHP + [my]SQL. Web security is a complex topic, and when you start asking about SQL injection attacks in a PHP programming environment, you're going to get a mess of answers that mix fact and opinion, and where there is also concern that simply telling you to "use parameterized queries" is going to miss some important points that will matter in specific environments, or matter to a question that seems unclear about whether all it needs to know is SQL injection prevention, or whether it's really a broader "how do I prevent things like SQL injection and XSS in PHP" or even really more of just "how do I stop my web application from getting hacked." Not to mention that simply telling you what to do without telling you what that means and how to do it can easily result in you still doing the wrong thing.

For example, "use PDO" would be one possible (basic, simplified) PHP+mySQL answer, if the answer assumed that you already have a basic enough grasp of web SQL security to understand query parameterization, and assumed you just needed to know how to apply that knowledge to PHP. Granted, PDO isn't the only built-in library that allows parameterized queries. But it's also not really, without further explanation, the appropriate answer for someone who doesn't even understand basic SQL injection and modern counter injection principles to begin with. Because it's possible to write injectable queries using PDO all day long, if you're not writing them correctly.

Someone else might say that with a perfect filtering algorithm, your SQL can't be injectable. And they'd be technically right (in that specific context of perfection/etc, and overlooking how this places absolute requirements of never making a mistake in coding all related calls by forgetting to filter, and the change in where this relies on exploits/bugs never occurring)… assuming everything stayed in ANSI/CP1252 instead of UTF-8/UTF-16… and then it depends on the collation, and whether you're ever doing things like reading from and writing back to the database internally, particularly if you have different character encodings between your php program and your SQL storage.

Hopefully my point that some topics require a lot more nuance than the question easily exposes when it's asked naively or with imprecision as to the asker's knowledge state and specific needs (or when those are too broad) is starting to make some sense.

I'm sorry that this can result in frustration for someone who just wants a quick "do this and it will work."

12

There are different ways you can go depending on what type of question it is:

Practical Questions

For example, how do I do X with library Y. Or "Can someone tell me why this code doesn't work/produce output Z". Basically every question that is answered by a bunch of code and an explanation to it.

In this case, it's your task to try out the answers in the question and evaluate which one is correct. If you then have any follow-up questions, feel free to ask them.

Theoretical/Conceptual Questions

Like: "What does the fourth row in a transformation matrix do?", "What is the mathematical concept behind XYZ?".

In this case it might be really hard (or impossible) to evaluate the answers yourself since trying them out is not an option. For such questions, I would go and ask a new question in the form of:

While reading the question "Why are smurfs blue?", I stumbled over two answers which in my opinion contradict each other:

While answer A (link) states that it is a chemical reaction to their environment, answer B claims that it's in their DNA. I think that only one of the answers can be true because of blablabla.

Can someone explain me how both of them can be true, or point out which one is the correct answer?

But please make sure that you did your research here and that you have a strong point in why the answers contradict.

8
  • 12
    Be careful now, you may be creating a new meme accidentally.
    – Mr Lister
    Commented Feb 24, 2018 at 12:27
  • @MrLister what? Is asking about smurf off topic on SO? Why the heck mods hate clearly software development questions?!?!?
    – Braiam
    Commented Feb 24, 2018 at 12:48
  • 1
    I didn't want to hurt the feelings of any smurfs or other animals/people/SO-members with blue body parts :)
    – BDL
    Commented Feb 24, 2018 at 12:51
  • Smurfs have rights you know... They are people too (sort of)
    – VDWWD
    Commented Feb 24, 2018 at 12:51
  • 1
    Yes, more often when I have the option of experimentation, I don't even need to ask anything.
    – WGroleau
    Commented Feb 24, 2018 at 13:13
  • 8
    What about out of the blue questions?
    – Cœur
    Commented Feb 26, 2018 at 3:52
  • 6
    The problem, I think, is a security best-practices question, which is not solved by "try and see if it works" and in fact can have multiple, correct (at the time), and possibly contradictory answers as different attack modes are discovered. Not to mention the highest-voted and accepted answers for these sorts of questions can much more easily be outdated or wrong if the question is not curated.
    – Daniel F
    Commented Feb 26, 2018 at 12:22
  • 1
    great answer, works in an even more general case as well, unlike the useless "Stack overflow is many things, but it isn't a place for learning!" garbage.
    – Krupip
    Commented Feb 26, 2018 at 15:20
11

Stack Overflow is many wonderful things, but it is not a class in fundamentals (on any topic).

If you are learning PHP or mySQL you should learn it from a source designed to teach it to you. A textbook, website or video and 2 to 10 hours (depending on how much of a newbie you are to programming.) If you expect Stack Overflow to do this basic grunt work for you by "researching" or asking a basic question it is rare it will work.

If your question is not a fundamental question I'd be interested to hear what it is which resulted in such a range of responses. What you are describing sounds like one of these questions.

7
  • 8
    A retired software engineer who’s a newbie to PHP. A tutorial that’s so fundamental everything it says is obvious doesn’t help with the non-obvious that I’m looking for. A huge pile of unrelated information that contradicts itself is also not helpful. Nor is people taking the ISP help desk approach of assuming the customer is an idiot.
    – WGroleau
    Commented Feb 26, 2018 at 11:58
  • 7
    @WGroleau We're all idiots most of the time, so it's a good assumption. That you've written software for 30 years doesn't change this. (On the contrary, having done it for 30 years, you should be painfully aware of all the stupid things you've done along the way.) That said, take special note of the last paragraph of this answer. I understand you're frustrated, but do you want to rant and be validated or are you looking for help? That you've not yet taken the time to clarify and respond to requests for info are a red flag that you may not have done so with your SO question, either.
    – jpmc26
    Commented Feb 26, 2018 at 15:37
  • I wrote a trivial SQL query to select two strings from a huge table, after spending a day cleaning up the garbage that others had put into the table. Since I had also spent half a day unsucessfully looking for a similar data set that wasn't contaminated, I thought it would be nice to share it. Several PHP tutorials failed to mention SQL injection. I spent years doing SQL, but injection was not a risk in my environment, and PHP wasn't used. So I knew about it but I wasn't about to write a bunch of sanitation code without trying to find out what PHP already offered.
    – WGroleau
    Commented Feb 26, 2018 at 16:06
  • 2
    And If the research to determine which answers are garbage and which are correct takes longer than reading those answers, then I might as well just do the research and forget about SE. But I retired and intend to act like I'm retired. If 28 people who are or think they are PHP/mySQL experts can't agree on it, then I'm not about to spend that much time to become more of an expert just to safely share a single SQL select query.
    – WGroleau
    Commented Feb 26, 2018 at 16:11
  • 1
    In most tags, my experience is the opposite: ask any dumb question on things that you should definitely know after reading a good reference book (or, you know, the freaking official manual), and you'll be inundated with copies of the same answer from FGITW users. If you're lucky, someone will go to the trouble of finding the appropriate duplicate question, which no doubt exists. The notion that "it is rare it will work" is wishful thinking. Dumb, fundamental questions are exactly where SO will definitely work -- where it doesn't, your question may very well not be so dumb. Commented Feb 26, 2018 at 16:52
  • @wgroleau I'm sorry if the tone of my answer was insulting, I don't mean it in that way. However, I stick to my point.... If you are building a web site/application on PHP and SQL then you should learn how to do so from a media source that shows how to do so without injection risk. Any other "method" of implementation for a new platform is unadvisable. Maybe you got "unlucky" with a bad teacher, book, web tutorial, etc.which is why I like to look at two or three sources when I learn a new stack.
    – Hogan
    Commented Feb 27, 2018 at 12:54
  • @WGroleau The problem here is the PHP ecosystem. It is well known for its history as an insecure platform, and it's widely believed to be a really terrible language to work in. My advice is find a better language if you don't want a bad experience. =) I'm a fan of Python, personally. C# is pretty good. I can't speak to Java or Ruby or Go or Rust too much, but they're probably better than PHP. Stay away from JavaScript.
    – jpmc26
    Commented Mar 10, 2018 at 0:48
8

I feel this needs to be said, since it looks like none of the answers address your key question:

How is a person who does not know something supposed to evaluate answers offered when they contradict each other?

The answer is by knowing how Stack Overflow works. We vote things up that are good, and vote things down that are bad.

Although vote casting is guided by some principles (seen by hovering over the voting arrows), in the end, "good" and "bad" are ultimately subjective. The hope is that the majority of the crowd will have enough of a sense of what good and bad are that the 'right' answer floats up to the top.

The question you're obviously referring to is How can I prevent SQL injection in PHP? The highest-voted answer has 7542 votes - a huge number, and about 5x the number of the next-highest voted question. It also has a 50 point bounty on it, which means someone was willing to use 50 points of their own reputation to say "I like this!". But it doesn't answer your question, as it makes no mention of mysql_real_escape_string.

The next-highest voted answer has a score of 1441, almost twice that of the next one below it. At the very top of it is a very clear disclaimer that mysql_real_escape_string is obsolete. You don't see a reference to mysql_real_escape_string again until 4 answers below that, in an answer that has only 479 votes. And the answer below that, with 431 votes, has a big disclaimer talking about mysql_real_escape_string not being the best solution to SQL injection issues, complete with references to read as to why.

I know nothing about PHP, and very little about SQL injection, but from this search, I can walk away with the following conclusions:

  • mysql_real-escape_string is now obsolete
  • even when it wasn't, it likely wasn't the best solution

And that's a key thing - especially given the references explaining why not to use mysql_real_escape_string, I would then walk away. You don't have to read every answer, and you absolutely shouldn't trust every answer. The way SO works is what's supposed to be the best answer rises to the top.

(Or you could read all the answers and all the comments, and learn a lot - but the nature of this site is that the lower down an answer is, the less valuable it is to the community at large. The first answer I saw that seems more positive to mysql_real_escape_string only has a score of 155 points. All the ones above it that warn you of its problems should give you a hint that only 155 points shouldn't be taken with the same credence as all the 300+, 400+ and 1400+ above it.)

TL;DR: (Too long; didn't read): You can best know the consensus of the SO community by looking at the score of a question or answer.

Incidentally, you can best contribute to this community by adding your own votes. Upvote questions that are useful to you and downvote those that are not good answers. The most deserving answers will then be read first.

4
  • Yes, one answer has a lot more votes than others. But when wrong answers get that many votes, one wonders how many of the voters on other answers have no clue. Before I retired, I was once forced to award a bounty to a WRONG answer. It was the only answer, and I didn't accept it because I had verified that it was wrong. But the rules say, ....
    – WGroleau
    Commented Feb 27, 2018 at 11:25
  • 1
    Don't trust this answer. It has only half of the votes of the most upvoted answer ;-)
    – testing
    Commented Feb 27, 2018 at 12:15
  • Excellent answer Scott, covers a key point I did not include.
    – Hogan
    Commented Feb 27, 2018 at 12:43
  • 1
    Great explanation. But worth pointing out that there's still risk of the crowd getting it wrong. Two instances to consider: Fixing answers that recommend chmod 777 | Poorly worded 8 year old question with hundreds of votes and security implications
    – jscs
    Commented Feb 27, 2018 at 13:43
1

I have come across the same issue, although I didn't open a question but I actually had a seemingly simple question to which i found lots of answers and debate.

I think if the question is truly simple you will get the kind of answer you are looking for and if it is not, you will find this kind of answers that seem contradictory and long-winded.

I think this is part of the learning process, and although it can be annoying you will probably find you grew more as a professional with the complex answer you found than if you have gotten the simple one.

As to how to approach this situation. First, lets face it, it won't be simple, you will have to read through it all. And cross-reference any information the answers have. Also you will have to check the dates of the answers, because technology changes frequently. I know how annoying this can be when you are in sort of a hurry.

Once you have gone through that process you will most likely know what you need, or you will understand enough that you will be able to refine your question and maybe find a more direct answer to your question, or even have to post it because no one else has asked it before.

Many times when I am trying to learn something I actually use this approach because it opens up many paths and helps you deepen your understanding. And sometimes you find that what you thought you wanted, was not really what you really wanted/needed.

Also deepening your understanding will help you search in a more efficient way. For example in this case it seems you wanted to use a command (I have never worked with PHP), and it turns out it no longer exist. My guess is that you should be able to find that out without asking here. For example going first to the documentation page for that command (of course sometimes, we are not so lucky as to have documentation available anywhere, but still is a good step to look for it first)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .