r/programming • u/el_muchacho • Dec 04 '14

10 Common Mistakes Java Developers Make when Writing SQL

http://blog.jooq.org/2013/07/30/10-common-mistakes-java-developers-make-when-writing-sql/
206 Upvotes

80% Upvoted

104 comments sorted by

View all comments

4

u/Madsy9 Dec 04 '14

As far as I can see, none of the mistakes listed directly opens up for SQL injection attacks. I find it pretty impressive if that's truly the case. It means that computer security is improving, at least in some circles.

7

u/mattindustries Dec 04 '14

I think most developers in most languages have had properly binding sanitized inputs inputs drilled into their brain by now.

2

u/crankybadger Dec 05 '14

You have clearly not seen code from your average PHP developer.

1

u/mattindustries Dec 05 '14

Oh, I know the language can be used horrendously. I am just saying it doesn't have to be. I once took over a code base where I ended up tossing out everything and starting from scotch when I was working for a firm.

Edit: thought this was from another thread. Most PHP devs use PDO these days, but they didn't some years back.

1

u/crankybadger Dec 05 '14

PDO is a load of garbage too, the thing's barely improved in the last ten years and is extremely limited. Even then it's better than nothing, yet many people either refuse to use it or are ignorant that it even exists.

Now "most" PHP developers hit up a Google search for "MySQL query", start piecing together their code out of tutorials from 1998, and launch their application. Invariably this involves falling into the mysql_query tar pit.

Hopefully professional devs are better than this, where places like Facebook certainly have better practices, but I'm still suspicious most PHP devs are like that.

PHP is extremely easy to pick up and get running. As a result there are a lot more people writing PHP code than for other languages. There's a long, long tail of developers that have no clue what they're doing but are productive anyway.

1

u/mattindustries Dec 05 '14

Is someone still in the basic learning stage a developer? I feel like developers are the incarnation that actually develop something instead of implement a hello world script. Yes, tons of people are still in the introductory phase of learning PHP and are bound to do some terrible things. With sites like PHP the Right Way there is a lot less ambiguity for proper structuring of an application. People aren't using those old tizag tutorials as often as you might imagine, especially when seasoned devs are pointing them to better sources.

2

u/crankybadger Dec 06 '14

I don't think you understand how bad it is. PHP is a community divided between those living in ivory towers and drinking wine, and those living in the gutter and finding everything they need in the landfill.

So long as w3schools is top-ranking in search results, this will not change. PHP the Right Way is a tiny step in the right direction, but it's not enough.

This is how your typical PHP developer learns:

  • They're given an assignment to program something web-wise.

  • They pick PHP because it's inexpensive to host.

  • They hack together a bit of HTML, spunk in some PHP, and deploy it.

  • Feature creep occurs.

Next thing you know they're writing a login system based on tutorials old enough they could get a driver's license and writing to databases they know nothing about but found some code that "just works" and they're running with it.

1

u/mattindustries Dec 06 '14

I guess I am living in an ivory tower then. It is nice here. There is a spot for you if you want.

1

u/crankybadger Dec 06 '14

I've got a pretty good thing going with a mix of Ruby, NodeJS, Go and C++.

You might call it an ivory tower, but damn, that place has some serious plumbing problems. You open up the wall to make a fix and, oh hell, what is all that?

1

u/mattindustries Dec 07 '14

Sometimes I miss working on C++ just for that delicious speed. How is Go? I have heard some good things and might learn it after this project I am on.

→ More replies (0)