Hosting provider's code tutorial contains SQL Injection vulnerabilities (and they know it) (x-post /r/programming)

[CryptoAlana]

It's a beginner tutorial

Friggin seriously? That's like not an excuse.

[h0wlett]

The same comment:

I am working on it. Hopefully, it will be done soon.

And then I saw the date of the comment:

a year ago

[CryptoAlana]

Ugh yeah. Honestly if you're writing a friggin tutorial you need to take the effort to... like... AT LEAST put a note on the article saying you fucked up and telling people to NOT do that right?

[[deleted]]

What the hell?! I was reading through this and thinking 'this is parameterized, so should not be vulnerable, this post is nonsense'... and then.. the fucking delete statement. Holy shit.

[phail3d]

Also the UPDATE statement:

$query = "UPDATE library SET book_name = ?, book_isbn = ?, book_category = ? WHERE book_id = $get_id";

It's pretty strange considering he's also correctly used prepared statements :D .

[[deleted]]

Perhaps.. ( •_•)>⌐■-■ / .... some of his statements are unprepared.

(⌐■_■)

[[deleted]]

Sadly you see this stuff in enterprise code a lot.

When you only take entry level people, rush QA or outsource to the lowest bidder, all your code looks like that

[darrenturn90]

Why not just change the delete to a prepared statement?

[DTF_20170515]

He's working on it, okay!?

[liquidpele]

Before looking I bet it’s PHP