Comment on Life isn't easy if your last name is 'Null' as it still breaks database entries the world over

undefined@lemmy.hogru.ch ⁨6⁩ ⁨days⁩ ago

• timuchan@lemm.ee ⁨6⁩ ⁨days⁩ ago

  This was my thought as well, sanitize your inputs! Are they not quoting/casting to string before input?

  source

  • undefined@lemmy.hogru.ch ⁨6⁩ ⁨days⁩ ago

    Unless you’re coding from scratch it’s hard to not do this with any modern framework.

    source

    • limer@lemmy.dbzer0.com ⁨6⁩ ⁨days⁩ ago

      Legacy systems still handle more traffic than modern ones, I’d wager

      source

      • T156@lemmy.world ⁨6⁩ ⁨days⁩ ago

        And it’s probably not seen as urgent enough an issue to need replacing the whole system for.

        source
      • acosmichippo@lemmy.world ⁨6⁩ ⁨days⁩ ago

        any govt system.

        source
    • limer@lemmy.dbzer0.com ⁨6⁩ ⁨days⁩ ago

      Word press code, and plugins, do not sanitize out of the box. You have to call an additional function, each time, that is not provided automatically. Many home made plugins miss that; many popular plugins used to be home made ones

      source

      • PixelTron@lemm.ee ⁨6⁩ ⁨days⁩ ago

        Wordpress is a sin against mankind.

        source

        • -> View More Comments
    • SkaveRat@discuss.tchncs.de ⁨6⁩ ⁨days⁩ ago

      A couple years ago I wanted to write a simple website with SQL injection vulnerability, so I could demonstrate sqlmap to someone

      It was surprisingly difficult (and every fiber in my body screamed)

      source

      • fuckwit_mcbumcrumble@lemmy.dbzer0.com ⁨6⁩ ⁨days⁩ ago

        Imagine how hard it is to be this bad. Yet still people manage to do it.

        source
    • Cocodapuf@lemmy.world ⁨6⁩ ⁨days⁩ ago

      Unless you’re coding from scratch it’s hard to not do this with any modern framework.

      I think that word modern is doing a lot of heavy lifting there.

      A lot of systems simply aren’t modern. There’s always that mentality of “well, it’s been working for the last 12 years, let’s not mess with it now”, despite all the valid objections like "but it’s running on Windows2000” or “it’s a data beach waiting to happen”…

      source

      • undefined@lemmy.hogru.ch ⁨5⁩ ⁨days⁩ ago

        Is it though? I haven’t used a framework since probably 2007 that doesn’t do this. There are the smaller, more DIY frameworks out there but I’ve never used them professionally.

        source
      • Llewellyn@lemm.ee ⁨5⁩ ⁨days⁩ ago

        What is a data beach?

        source

        • -> View More Comments
• livingcoder@programming.dev ⁨6⁩ ⁨days⁩ ago

  It happened to a friend who wasn’t passing in the proper types into their stored procedures, all strings, and “null” (not case sensitive) conflicted with actual null values. Everything in the web interface were strings, and so was null.

  For some people it takes this mistake before they learn to always care about the data types you’re passing in.

  source
• Dasus@lemmy.world ⁨6⁩ ⁨days⁩ ago

  With LLM coding increasing, it might be going up. Idk am no pro, just worried.

  Tangential, but I find it hilarious how Gemini’s syntax fucks up all the time.

  I ask it to change my light called “CX2” to red. It complies, like usual, and it reads Okay, changing “CX2” to red., but what it says out loud is Okay, changing "CX two inches to red.

  source
• sugar_in_your_tea@sh.itjust.works ⁨5⁩ ⁨days⁩ ago

  As a backbend dev, I blame DBAs. We were forced to support CSV imports from out support team so they could fix data issues on their own, and now we have some wonky data in prod…

  source

  • undefined@lemmy.hogru.ch ⁨5⁩ ⁨days⁩ ago

    Yeah that’s a whole other can of worms. I see this a lot at work where people are asking for direct database credentials and cringe every time.

    source
  • undefined@lemmy.hogru.ch ⁨5⁩ ⁨days⁩ ago

    Lately I’ve been dealing with tons of invalid byte sequences in MySQL dumps and it makes me question what the hell they’re allowing in there.

    source