It happened to a friend who wasn’t passing in the proper types into their stored procedures, all strings, and “null” (not case sensitive) conflicted with actual null values. Everything in the web interface were strings, and so was null.
For some people it takes this mistake before they learn to always care about the data types you’re passing in.
timuchan@lemm.ee 3 months ago
This was my thought as well, sanitize your inputs! Are they not quoting/casting to string before input?
undefined@lemmy.hogru.ch 3 months ago
Unless you’re coding from scratch it’s hard to not do this with any modern framework.
limer@lemmy.dbzer0.com 3 months ago
Legacy systems still handle more traffic than modern ones, I’d wager
T156@lemmy.world 3 months ago
And it’s probably not seen as urgent enough an issue to need replacing the whole system for.
acosmichippo@lemmy.world 3 months ago
any govt system.
limer@lemmy.dbzer0.com 3 months ago
Word press code, and plugins, do not sanitize out of the box. You have to call an additional function, each time, that is not provided automatically. Many home made plugins miss that; many popular plugins used to be home made ones
PixelTron@lemm.ee 3 months ago
Wordpress is a sin against mankind.
SkaveRat@discuss.tchncs.de 3 months ago
A couple years ago I wanted to write a simple website with SQL injection vulnerability, so I could demonstrate sqlmap to someone
It was surprisingly difficult (and every fiber in my body screamed)
fuckwit_mcbumcrumble@lemmy.dbzer0.com 3 months ago
Imagine how hard it is to be this bad. Yet still people manage to do it.
Cocodapuf@lemmy.world 3 months ago
I think that word modern is doing a lot of heavy lifting there.
A lot of systems simply aren’t modern. There’s always that mentality of “well, it’s been working for the last 12 years, let’s not mess with it now”, despite all the valid objections like "but it’s running on Windows2000” or “it’s a data beach waiting to happen”…
undefined@lemmy.hogru.ch 3 months ago
Is it though? I haven’t used a framework since probably 2007 that doesn’t do this. There are the smaller, more DIY frameworks out there but I’ve never used them professionally.
Llewellyn@lemm.ee 3 months ago
What is a data beach?