Bad programming!

gav on 2002-11-03T17:07:59

Googlism is the source of some amusing things but that doesn't mean they are exempt from simple programming mistakes. You shouldn't use user input directly in a database query. If your DB library supports bound variables, use them.

Googlism for: gavin's house
MYSQL Error in query: INSERT INTO googlism (ism,alpha,date,type) VALUES ('gavin's house', 'g', now(), '1') Error: You have an error in your SQL syntax near 's house', 'g', now(), '1')' at line 1


Worse

Matts on 2002-11-03T19:54:10

This is worse than bad programming. It's a SQL Injection vulnerability.

Re:Worse

gav on 2002-11-03T22:23:16

That's what I told them in an email. I didn't want to give anyone any ideas about going and doing something nasty :)