• Bob the guest (unregistered)

    How old is this code? No one has used mysql_query in years.

  • (nodebb)

    Plot twist: It's within the last few years. You'd be surprised at the number of ignorant "developers" out there, and PHP probably attracts the absolut dregs.

  • (nodebb)

    I know the perpetrators of this code don't care, but it BUGS me when they mix ANSI joins with where-clause joins in the same stinking query.

  • Álvaro González (github)

    I stopped paying attention at the very beginning, where it splits file lines as array elements just to immediately concatenate them into a string.

  • Álvaro González (github) in reply to Bob the guest

    How old is this code? No one has used mysql_query in years.

    People keep saying it's "deprecated" when in fact it was entirely removed from the language years ago, so you can't even use it if you want...

    Unless... 😳

  • Argle (unregistered)

    I got into a short flame war with someone on YouTube who was singing the praises of a recent release of PHP. I pointed out that developers could still pull the same old crappy stunts with PHP that they always could. He rather smugly condemned me for not understanding "backward compatibility." At that point, I decided that backward compatibility isn't truly sacrosanct. Maybe -- just maybe -- vast chunks of PHP should be declared "deprecated" and maybe the programming world would be a better place.

  • (nodebb)
    Comment held for moderation.
  • Álvaro González (github) in reply to Argle

    I pointed out that developers could still pull the same old crappy stunts with PHP that they always could.

    Honest question: how do other languages prevent that? (Aside from being too difficult to use so bad devs don't even care, which I assume isn't what you mean).

  • (nodebb)

    I R Disappoint.

    Remy, you missed the SQL injection vulnerability in this line of code found in the "first major block of code":

    $data_query = mysql_query("SELECT p.products_price, pd.products_name, pd.products_description, p.products_id, s.specials_new_products_price, p.products_image FROM " . TABLE_PRODUCTS . " p LEFT JOIN " . TABLE_SPECIALS . " s ON p.products_id = s.products_id, " . TABLE_PRODUCTS_DESCRIPTION . " pd WHERE p.products_id = pd.products_id AND pd.language_id = '" . $_SESSION['languages_id'] . "' AND p.products_id IN(" . join(",", $_POST['directors1']) . ")");
    

    Probably the $_SESSION['languages_id'] is OK, depending on exactly where the language ID came from, but the $_POST['directors1'] is (unless I'm being deceived by its name) sourced directly from the body of the POST request.

  • (nodebb) in reply to Steve_The_Cynic

    Ha, yeah indeed. I literally stopped reading the post after this line because nothing else can top the "fire the developer now, he is a security risk" issue :-)

  • Argle (unregistered) in reply to Álvaro González
    Comment held for moderation.
  • Seirios (unregistered)
    Comment held for moderation.
  • (nodebb)

    It's very 20 years ago PHP code. To some extent that's understandable, as it's sending HTML Email, but in so many other ways it's really not...

  • ismo (unregistered)

    The very first line has check for 'action' not being empty and then that it is 'send'. Why the empty check is needed ? Tells everthing about this developer.

    if(!empty($_GET['action']) && ($_GET['action'] == 'send') )

  • löchlein deluxe (unregistered) in reply to ismo

    I'm pondering my magic 8ball and it says: ops told them to fix the host of warnings about accessing undefined array members but never had time to double-check if they did.

  • Lutz (unregistered) in reply to ismo
    Comment held for moderation.
  • (nodebb) in reply to Steve_The_Cynic

    Came to look for this exact reply.

    I saw it, my mind basically glossed over the rest of the article, I did a quick skim to see if Remy spotted it, he didn't, so didn't bother with the rest of the article and came to the comments instead :)

  • TheMonkey (unregistered) in reply to ismo
    Comment held for moderation.
  • RLB (unregistered) in reply to Bob the guest
    Comment held for moderation.
  • (nodebb) in reply to ray73864

    Likewise.

    I decided if that wasn't bad enough to be called out, then I really didn't want to the the rest. It's like if there's some sort of massive disaster in a sausage making factory and somebody says "you gotta see the carnage but then walks past a severed arm in the doorway without even mentioning it...

  • Airdrik (unregistered)
    Comment held for moderation.
  • Missing Semicolon (unregistered)

    TRWTF is surely building all this stuff in the front-end to begin with. Is back-end development that hard?

Leave a comment on “Don't Read This Email”

Log In or post as a guest

Replying to comment #:

« Return to Article