The daily WTF Greatest Hits II

function saveform()
{
  var firstName = escapeSql(mainForm.elements.txtFirstName.value);
  var lastName = escapeSql(mainForm.elements.txtLastName.value);
  /* ... */
  var offerCode = escapeSql(mainForm.elements.txtOfferCode.value);

  var code =
  '  $cn = mssql_connect($DB_SERVER, $DB_USERNAME, $DB_PASSWORD)           ' +
  '          or die("ERROR: Cannot Connect to $DB_SERVER");                ' +
  '  $db = mssql_select_db($DB_NAME, $cn);                                 ' +
  '                                                                        ' +
  '  if (mssql_query("SELECT 1 FROM APPS WHERE SSN=\''+ssn+'\'", $cn)) ' +
  '  { $ins = false; }                                                     ' +
  '  else                                                                  ' +
  '  { $ins = true; }                                                      ' +
  '                                                                        ' +
  '  if ($ins) {                                                           ' +
  '    $sql = "INSERT INTO APPS (FIRSTNM, LASTNM, ..., OFFERCD) VALUES ("; ' +
  '    $sql+= "\''+firstName+'\',";                                        ' +
  '    $sql+= "\''+lastName+'\',";                                         ' +
  '    $sql+= "\''+offerCode+'\')";                                        ' +
  '                                                                        ' +
  '  /* ... */                                                             ' +
  '                                                                        ' +
  '  mssql_query($sql, $cn);                                               ' +
  '  mssql_close($cn);                                                     ';

  execPhp(code);
}

Posted in WTF? | 3 Comments »

(No Ratings Yet)

 Loading ...

3 Responses to “The daily WTF Greatest Hits II”

1. koke says:

   April 13, 2006 at 4:19 am

   This one is definitely winning my personal contest of worst code piece ever by now:

   function saveform()
   {
     var firstName = escapeSql(mainForm.elements.txtFirstName.value);
     var lastName = escapeSql(mainForm.elements.txtLastName.value);
     /* ... */
     var offerCode = escapeSql(mainForm.elements.txtOfferCode.value);
   
     var code =
     '  $cn = mssql_connect($DB_SERVER, $DB_USERNAME, $DB_PASSWORD)           ' +
     '          or die("ERROR: Cannot Connect to $DB_SERVER");                ' +
     '  $db = mssql_select_db($DB_NAME, $cn);                                 ' +
     '                                                                        ' +
     '  if (mssql_query("SELECT 1 FROM APPS WHERE SSN=\''+ssn+'\'", $cn)) ' +
     '  { $ins = false; }                                                     ' +
     '  else                                                                  ' +
     '  { $ins = true; }                                                      ' +
     '                                                                        ' +
     '  if ($ins) {                                                           ' +
     '    $sql = "INSERT INTO APPS (FIRSTNM, LASTNM, ..., OFFERCD) VALUES ("; ' +
     '    $sql+= "\''+firstName+'\',";                                        ' +
     '    $sql+= "\''+lastName+'\',";                                         ' +
     '    $sql+= "\''+offerCode+'\')";                                        ' +
     '                                                                        ' +
     '  /* ... */                                                             ' +
     '                                                                        ' +
     '  mssql_query($sql, $cn);                                               ' +
     '  mssql_close($cn);                                                     ';
   
     execPhp(code);
   }
   

   I wonder who’d kill who if someone saves the HTML code and changes $sql to DELETE FROM APPS.

   Via Client-side PHP

   Reply
2. Raphink says:

   April 14, 2006 at 2:04 am

   Wow that is really stupid indeed!
   Would be faster to just print the db url, user, and passwd on the website if this guy wants his db to be borked

   Reply
3. DidieR says:

   April 25, 2006 at 6:26 am

   Ouh… “Les grands esprits se rencontrent”…

   In fact, this is pretty stupid. I don’t hack much.. But I see that this is stupid though…

   Reply