When I saw code like this in a production app, I was speachless:
if (matcher.Trim().Length > 0)
{
if (eesteWhere){sqlWhere += "WHERE ";eesteWhere = false;}
else{sqlWhere += "AND ";}
sqlWhere += "m.matcher like '" + matcher.Trim() + "%' ";
}
Not once, twice, but hundred of fragments like these. Not generated, but hand copy-pasted. And the client thought they were running stable, reliable apps :(
This is soo XSCD ‘Exploits of a Mom‘ (aka Bobby Tables):
The department that wrote the code has been closed a while ago, but some serious refactoring time needs to be invested here, as all applications delivered by that department are vulnerable to SQL Exploits.
–jeroen
The Wiert Corner - irregular stream of stuff 