This is real.

String query = "select password from users where username = " + username;

Every single login or db question I see on stackoverflow has shit like this, it's scary to think these people are out there coding things we might be using...

How else can you send the user his password when he has forgotten it? /s

Yeah, I have to confess my first C# code probably looked like that before I discovered entity framework and Nhibernate.

... And that if I ever do PHP again it's gonna look like that on purpose

I'm no backend, what is so bad? (Other that possibly not escaping SQL, which I assume would have been done earlier in the code)

@retnikt SQL Injection.

@Retnikt Like @PrivateGER said because of SQL Injection. Thats why most of Websites only allow to reset your password instead of sending it to you.

Prepared statements are not only more secure than this, but they are also easier to implement (no awkward string concatenation). So doing stuff like this isnt even lazy, its just totally negligent.

Hiiii! I'd like to log in, please? My username is "A'; select * from users; --". Thanks!

And its probably not hashed?

I mean negligence sure... But screwing with my data(password cant be reused because of people like this...)

@retnikt lol, it says "select password from ...". It just returns password lol

It’s the exact reason why SQL injection has remained a top vulnerability for more than 15 years. I guess some lessons are perpetually ignored

I wouldn't harass newbies about this, because they're still learning. I would guess that many of us here have done something like this at least once. It would be best to warn them about SQL injection without calling them stupid.

worst nightmare

Does not matter when you have #amazingsecurity

@Codex404 you don't. That's why if you forget your password you can create a new one.

@Dollique the /s means sarcasm ;-)

@Codex404 ikr? 😂

@Gigex Thank goodness for that I was about to trigger so hard 😂

@finiteAutomaton But if you dont know how to protect yourself against something as painfully trivial as SQL injection, I doubt you have anything even vaguely resembling #amazingsecurity

@CrashOverride At least you can try to convince your customers on twitter that it is still amazingly good.

@finiteAutomaton 😂

How has nobody posted this yet?

https://xkcd.com/327/

Newbies do this a lot