Shame because that guy has like 50k rep on the cooking site, so he's not just new.
But looking into it, it seems he works for a government agency and is really pissed about new regulations that require government sites use HTTPS, so he's now trying to convince us.
Well to be fair, the move does come with some complications, e.g. schools can no longer effectively use a caching proxy and DPI "child protection" without installing a root cert on all the computers.
And there's a lot of paperwork involved for a gov't site to move to HTTPS.
But you're right, it's really not that hard. People will survive.
Since Q4 2018 Facebook has removed over 3billion fake accounts thanks to advanced detection algorithms, more than 1/3 greater than the number of monthly users. Glad we don't have rich people problems.
When I have to write a function that accepts variable table and field names for select statements in php, my only surefire way to avoid sql injection is whitelisting table and field names, right?
@SonictheInclusiveHedgehog @JourneymanGeek That answer was plagiarized from a site that explicitly does not permit copying. Plagiarized content is considered TP for SmokeDetector feedback. As such, it really doesn't serve any purpose other than to link to the site, which is trying to sell DBA courses and a couple sys-admin courses. The account was also created today.
While there is a link to where the content is from, it does not meet the minimum referencing requirements for SE. In particular, it does not make any attempt to indicate that the content is not the OP's work, and definitely doesn't credit the original author or copyright holder.
Overall, that post, and the circumstances surrounding it, felt more like spam to me than an actual attempt to answer the question. It's possible that it was an actual attempt to answer, but with plagiarized content in violation of that site's copyright.
@Makyen on the other hand - that doesn't necessarily make it spam. If that had been a real question - and the first part of it did, on the appropriate site, that would have been a terrible but potentially valid answer
@JourneymanGeek No, plagiarized content is not a valid answer. The reality is that the question didn't ask about what the answer was talking about. However, I will grant that the words, if they were not plagiarized, could, potentially, be an answer to some hypothetical question.
I proposed a few duplicates on Meta tangentially related to my recent question meta.stackexchange.com/questions/328605/… and was advised to ping you people to get the close votes reviewed
the information about when SEDE receives updates has multiple near-duplicate answers, some of which are apparently obsolete and should be clearly marked as superseded
is it enough to ask you to visit the close review queue or should I post links?
I'm divided, on the one hand you want to try to be nice, on the other if it seems suspicious you want to expose it to the tooling we have so that you get a better analysis and possibly alerted about something more nefarious and systematic, or orthogonally no proof that anything else is wrong but that's still better than speculation
so really it boils down to whether it triggers your spider sense
@JourneymanGeek Had I come across it organically, I probably would have gone for just a custom mod-flag with explanation. Even with the SD report, raising a custom mod-flag, but giving TP feedback, would probably have been a better option than the spam flag I raised.
And while its useful - to a certain extent, smokey does amplify votes, so in this situation I'd rather have folks consider that too. If its clearly spam, like my new favourite spammer, I'd certainly not say a word (and go nuke the user afterwards)
@tripleee I've happily modhammered 2 of the 3 I saw on the queue
@Olivia That pattern looks like it's already caught by Potentially bad keyword in body and Potentially bad keyword in answer; append -force if you really want to do that.
Since this aint performance critical, I've settled on doing this, then looking up whether the table is one the procedure has permission from (and exists at all), then to look up if the field is in said table, and then doing the query
the only way to escape a name wrapped in backticks and inject some SQL is to terminate the backticks by using one in your input - but if the processing code removes backticks from your input before it ever gets shown to SQL, that vector has been rendered impossible
Aye, fair enough. So you've essentially got a choice between having a bug if your naming convention ever changes, or using a sanitization method that you're not 100% sure of. Maybe do some verification for your own peace of mind on that way of sanitizing names?
It's basically an internal version of dLookUp, e.g. it ends in SELECT $field FROM $table WHERE $condition a shorthand to write single line database queries. A ton of our code that I'm porting is written in that style, so I'm re-implementing it
But user data never goes into those, it's all data fetched by devs and the only user input is strictly numbers
so a sample call might be $dbModel->dLookUp('delivery_id', 'orders', 'order_id =' . (int)$order_id); I wonder if I need to be that cautious about sanitizing at all in that case.
It's easy to fall into the rep-w trap early on just by virtue of the site setup. The whole psychology of it funnels you into that behavior unless you actively fight it... if you even know to fight it.
Then there are the people who, rep aside, just want to help... and give OPs the benefit of the doubt... hoping the best of everyone.
naive or w... or both, I guess
@Tinkeringbell Blessing and a curse. When I think "you're an idiot" during the course of a conversation, my ears pin back reflexively. So, even though I think I'm keeping a straight face, my ears sort of telegraph my thoughts. Back in highschool, my mother pieced this together during an argument, flew into a rage, and slapped me.
