Is it time to start broadening the definition of duplicates?

Question

sql-injection is commonly a concern in PHP, and it is a common request to ask when presenting code for a Code Review here.

There are only so many ways you can propose a question that relates to SQL Injection in PHP.

This new question was posted today (cross posted from SO), which is what inspired this post:

• Injections and query

Previous questions as a search...

Answer 1

Obviously, SQL injection is a major source of anxiety among beginner PHP programmers. It doesn't help that the deck is stacked against them:

• The language makes it easy to do the wrong thing and hard to do the Right Thing.
• Learn PHP in n Hours books gloss over the subject, and even teach them to do the wrong thing. There are a lot of bad examples out there.
• Stupid language designers thought Magic Quotes would solve the SQL Injection problem, then recanted, adding to the confusion.
• Suddenly, the beginner learns of this problem called SQL Injection and a site called Code Review that could help them. Anything that we can do to wipe out this affliction from existence would be good.

From that perspective, I think that closing such questions as duplicates is a harmful attitude. Furthermore, we review all of the code, not just what is asked. If we manage to discover other bugs, we've provided value.

Therefore, we should continue to encourage all programmers to ask more questions — as long as they stay on-topic. If you think that this class of questions is "boring", perhaps you could come up with a canned response. If only I got a rep-dime every time someone asked about SQL Injection, I'd be rich!

Answer 2

From my own personal experience, finding accurate information regarding SQL injection, and even basic PHP security, is actually quite difficult for the novice. A search on Google can bring the best of tutorials and the worst of home-made blog posts. For the rookie, it all seems to work.

I think if we could offer these guys a good resource that stays up-to-date and offers multiple scenarios, we would find less of these questions. I'm sure that each question's author thinks that because their database scheme is "unique", a new SQL injection question is necessary. A thorough read that contained a generalized form of each best practice revolving around the SQL injection/PDO/MySQL/database access layer world would be great.

I agree with 200_success here, and we should encourage these questions and teach them, instead of closing their minds. Before they post though, if they could see some modern standards and current security trends, then we would be in better shape!

Answer 3

I'm not sure it's entirely appropriate to mark any questions concerned about injection as duplicates of any other question. Why? Because it's not a duplicate question. It's a new question about the same topic.

The appropriate response may be to down vote the question and leave a comment suggesting some reading material on the subject. I'm not convinced that a questions warrants a down vote just because it's a php & sql-injection question though.