<story><title>How not to protect against SQL injection (view source)</title><url>http://www.cadw.wales.gov.uk/</url></story><parent_chain><item><author>mixmax</author><text>No offense, but I think you&apos;re a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don&apos;t expect anyone to sue me for that.&lt;p&gt;Here&apos;s the mail I sent:&lt;p&gt;Hi there,&lt;p&gt;It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP.&lt;p&gt;Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: &lt;a href=&quot;http://news.ycombinator.com/item?id=2383857&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=2383857&lt;/a&gt;&lt;p&gt;It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: &lt;a href=&quot;http://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/&quot; rel=&quot;nofollow&quot;&gt;http://www.reddit.com/r/programming/comments/gdviz/how_not_t...&lt;/a&gt;&lt;p&gt;It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc.&lt;p&gt;I have nothing to do with these postings, I just don&apos;t like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions.&lt;p&gt;Hope you get it fixed before someone breaks it.&lt;p&gt;Yours,&lt;p&gt;Max</text></item><item><author>derleth</author><text>If you&apos;re lucky, you aren&apos;t in the UK so they won&apos;t be able to arrest you instantly on the hacking charges.&lt;p&gt;If you&apos;re very lucky, the place you are in won&apos;t honor their demands for extradition on the hacking charges.</text></item><item><author>mixmax</author><text>I just fired off an e-mail to point out that they have a potentially serious security problem and they should get it fixed ASAP.&lt;p&gt;I see this as a civic duty, and think that this is the kind of action you&apos;re required to perform if you see a serious problem. Writing an e-mail takes ten seconds, but the potential damage could well cost serious money.</text></item></parent_chain><comment><author>nowarninglabel</author><text>I wouldn&apos;t say they were paranoid. A few months back I showed a colleague what looked like the openings of a very serious data leak in a major company&apos;s site. He investigated further and then reported it up through the chain of command and then over to the company. At no point did he do anything other than what was done here, as in point out a publicly visible security flaw. He was nearly fired after the company threatened to sue. The company only relented when he agreed to keep quiet and his employers disciplined him. The employers didn&apos;t back him up. All this for solely reporting a flaw, absolutely zero use of said flaw.&lt;p&gt;I lost a lot of my faith in humanity that day.</text></comment>
<story><title>How not to protect against SQL injection (view source)</title><url>http://www.cadw.wales.gov.uk/</url></story><parent_chain><item><author>mixmax</author><text>No offense, but I think you&apos;re a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don&apos;t expect anyone to sue me for that.&lt;p&gt;Here&apos;s the mail I sent:&lt;p&gt;Hi there,&lt;p&gt;It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP.&lt;p&gt;Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: &lt;a href=&quot;http://news.ycombinator.com/item?id=2383857&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=2383857&lt;/a&gt;&lt;p&gt;It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: &lt;a href=&quot;http://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/&quot; rel=&quot;nofollow&quot;&gt;http://www.reddit.com/r/programming/comments/gdviz/how_not_t...&lt;/a&gt;&lt;p&gt;It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc.&lt;p&gt;I have nothing to do with these postings, I just don&apos;t like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions.&lt;p&gt;Hope you get it fixed before someone breaks it.&lt;p&gt;Yours,&lt;p&gt;Max</text></item><item><author>derleth</author><text>If you&apos;re lucky, you aren&apos;t in the UK so they won&apos;t be able to arrest you instantly on the hacking charges.&lt;p&gt;If you&apos;re very lucky, the place you are in won&apos;t honor their demands for extradition on the hacking charges.</text></item><item><author>mixmax</author><text>I just fired off an e-mail to point out that they have a potentially serious security problem and they should get it fixed ASAP.&lt;p&gt;I see this as a civic duty, and think that this is the kind of action you&apos;re required to perform if you see a serious problem. Writing an e-mail takes ten seconds, but the potential damage could well cost serious money.</text></item></parent_chain><comment><author>Stormbringer</author><text>I&apos;ve got $10 riding on &quot;they see the word Hacker in &apos;Hacker News&apos; and start freaking out&quot;.  :D&lt;p&gt;Oh, &lt;i&gt;I&lt;/i&gt; understand the word hacker in all its culturally and context relevant forms, and &lt;i&gt;you&lt;/i&gt; understand the word hacker, but &lt;i&gt;they&lt;/i&gt; do not understand the word hacker.  :-(</text></comment>