What a disaster! It had 28 answers, contradicting each other and most so full of information about things that were not asked, that it was difficult to understand them. And if I had enough knowledge about the topic to figure out which (if any) of the contradictions were correct, I would not have needed to ask the question.
Frequently, there are a small set of reasons this occurs:
- Imprecise question on a topic that actually has nuance and multiple answers that vary in appropriateness and correctness based on specific context.
- Question that confuses terms in such a way that it could be asking multiple different things, or where the question text is actually fundamentally different from the question title.
- Questions that actually cover multiple topics at once, or have severe topic crossover, or are better contextualized with a different approach than the one they've been placed in by how the question was asked.
- Topics where the best answer has evolved over time.
- Topics where there is a large difference between "good enough" answers, "best" answers, and "deceptively decent but fundamentally not ok" answers, and the differences are all highly technical.
"How is a person who does not know something supposed to evaluate answers offered when they contradict each other?"
Ultimately, Stack Overflow will never be a perfect resource when you're simply coming here for "just tell me what to do." That's not the intent it's meant to fulfill, and if you're not willing to do more research on a topic that receives a number of seemingly conflicting and technical answers, then it's generally a warning sign that you either need to find something else that just tells you what to do, or consider having someone else do that specific task for you.*
*This is not me saying I don't think you're capable of learning it. But rather, that a lack of desire to dig into a topic is usually a good signal that it's not something you're interested in learning to the depth required for that topic. It happens to me too, at which point I find ways to delegate it or contract it out, or slog through it knowing I probably am not doing as good a job as would be optimal and accept the related risks and costs.
It's ok to not be an expert at everything and not want to be one (or simply accepting that there just isn't time in the day to be one). But one also has to be realistic in those circumstances that if she isn't an expert, she isn't going to do as well (and/or work as quickly) as someone who is an expert.
To an extent, the best answers do generally rise to the top in terms of voting (and on complex topics where the question itself lacked nuance, the selected answer can prove to be misleading, even). Any time when there are non trivial differences between highly voted answers from the same time period, or where some of them are not merely extended clarifications/extra details of each other, it is a good signal that there are actual valid reasons for the arising ambiguity and that the topic is simply going to require more and deeper research.
Digging in more specifically, based on your comments on other answers, you seem to be asking PHP + SQL injection questions.
Several PHP tutorials failed to mention SQL injection. I spent years doing SQL, but injection was not a risk in my environment, and PHP wasn't used.
I'm not going to try to find specifically what question you landed on that's confusing you, but I would like to lightly address that confusion, in the context of what I've been trying to say here more generally.
At issue is that there is no entirely perfect bullet in the broader web security context simply by following some set of steps specific to PHP + [my]SQL. Web security is a complex topic, and when you start asking about SQL injection attacks in a PHP programming environment, you're going to get a mess of answers that mix fact and opinion, and where there is also concern that simply telling you to "use parameterized queries" is going to miss some important points that will matter in specific environments, or matter to a question that seems unclear about whether all it needs to know is SQL injection prevention, or whether it's really a broader "how do I prevent things like SQL injection and XSS in PHP" or even really more of just "how do I stop my web application from getting hacked." Not to mention that simply telling you what to do without telling you what that means and how to do it can easily result in you still doing the wrong thing.
For example, "use PDO" would be one possible (basic, simplified) PHP+mySQL answer, if the answer assumed that you already have a basic enough grasp of web SQL security to understand query parameterization, and assumed you just needed to know how to apply that knowledge to PHP. Granted, PDO isn't the only built-in library that allows parameterized queries. But it's also not really, without further explanation, the appropriate answer for someone who doesn't even understand basic SQL injection and modern counter injection principles to begin with. Because it's possible to write injectable queries using PDO all day long, if you're not writing them correctly.
Someone else might say that with a perfect filtering algorithm, your SQL can't be injectable. And they'd be technically right (in that specific context of perfection/etc, and overlooking how this places absolute requirements of never making a mistake in coding all related calls by forgetting to filter, and the change in where this relies on exploits/bugs never occurring)… assuming everything stayed in ANSI/CP1252 instead of UTF-8/UTF-16… and then it depends on the collation, and whether you're ever doing things like reading from and writing back to the database internally, particularly if you have different character encodings between your php program and your SQL storage.
Hopefully my point that some topics require a lot more nuance than the question easily exposes when it's asked naively or with imprecision as to the asker's knowledge state and specific needs (or when those are too broad) is starting to make some sense.
I'm sorry that this can result in frustration for someone who just wants a quick "do this and it will work."
@
syntax. (This also generates a notification for the target.) Please link the question as Clonkex requested.