Coding Horrors: You can gather all your technical debt into one easy framework!

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »

sklnd: Nov 26, 2007; NOT A TRACTOR

A coworker found some code yesterday in a queue implementation that, instead of using a locking mechanism to handle concurrent access, used taskLock() to disable context switching for the entire system in critical sections.

I believe the code was ported from Windows, so it was in a vxworks-friendly implementation of WaitForSingleObject()

# ? Jun 5, 2010 02:34

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 16:44

Flobbster: Feb 17, 2005; "Cadet Kirk, after the way you cheated on the Kobayashi Maru test I oughta punch you in tha face!"

sklnd posted:

A coworker found some code yesterday in a queue implementation that, instead of using a locking mechanism to handle concurrent access, used taskLock() to disable context switching for the entire system in critical sections.

I believe the code was ported from Windows, so it was in a vxworks-friendly implementation of WaitForSingleObject()

I remember the good old days when I learned a lot of my programming fundamentals on an Amiga, the official method for accessing certain system data structures was to make a system call to disable multitasking, read the values, and then re-enable it.

It sure was a shock at first to move to Windows after learning so many awful (but necessary) practices like that.

# ? Jun 5, 2010 03:22

Sewer Adventure: Aug 25, 2004

& anyone?

code:

// Check what Registered Types are turned on. This is a bit tricky since if two are 
// enabled, and one is off, it will return a number 2... not telling you which
// one is actually disabled. So we are literally checking to see if rnTypes matches 
// what is turned on, instead of by number. The "tricky" part is that the
// single notification types will only match if they are the ONLY one enabled.  
// Likewise, when we are checking for a pair of notifications, it will only be
// true if those two notifications are on.  This is why the code is written this way
if(rntypes == UIRemoteNotificationTypeBadge){
	pushBadge = @"enabled";
}
else if(rntypes == UIRemoteNotificationTypeAlert){
	pushAlert = @"enabled";
}
else if(rntypes == UIRemoteNotificationTypeSound){
	pushSound = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeAlert)){
	pushBadge = @"enabled";
	pushAlert = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeSound)){
	pushBadge = @"enabled";
	pushSound = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeSound)){
	pushAlert = @"enabled";
	pushSound = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeSound)){
	pushBadge = @"enabled";
	pushAlert = @"enabled";
	pushSound = @"enabled";
}

Sewer Adventure fucked around with this message at 04:35 on Jun 5, 2010

# ? Jun 5, 2010 04:33

Save the whales: Aug 31, 2004; by T. Finn

Sewer Adventure posted:

& anyone?

At least there is a huge explanation in comments. I'd prefer that, or even the "//oh my god I am so sorry for this" comment to none in either the code or the commit to the source repository.

# ? Jun 5, 2010 08:06

Yakattak: Dec 17, 2009; I am Grumpypuss
>:3

Sewer Adventure posted:

& anyone?

code:

// Check what Registered Types are turned on. This is a bit tricky since if two are 
// enabled, and one is off, it will return a number 2... not telling you which
// one is actually disabled. So we are literally checking to see if rnTypes matches 
// what is turned on, instead of by number. The "tricky" part is that the
// single notification types will only match if they are the ONLY one enabled.  
// Likewise, when we are checking for a pair of notifications, it will only be
// true if those two notifications are on.  This is why the code is written this way
if(rntypes == UIRemoteNotificationTypeBadge){
	pushBadge = @"enabled";
}
else if(rntypes == UIRemoteNotificationTypeAlert){
	pushAlert = @"enabled";
}
else if(rntypes == UIRemoteNotificationTypeSound){
	pushSound = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeAlert)){
	pushBadge = @"enabled";
	pushAlert = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeSound)){
	pushBadge = @"enabled";
	pushSound = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeSound)){
	pushAlert = @"enabled";
	pushSound = @"enabled";
}
else if(rntypes == ( UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeSound)){
	pushBadge = @"enabled";
	pushAlert = @"enabled";
	pushSound = @"enabled";
}

What the hell are you guys getting which types are enabled for? Doesn't this just take care of it?

code:

[[UIApplication sharedApplication] registerForRemoteNotificationTypes:(UIRemoteNotificationTypeAlert | UIRemoteNotificationTypeBadge | UIRemoteNotificationTypeSound)];

# ? Jun 5, 2010 17:43

Sewer Adventure: Aug 25, 2004

Yakattak posted:

What the hell are you guys getting which types are enabled for? Doesn't this just take care of it?

Was looking for some examples of push notifications and I found it on google code.
http://easyapns.googlecode.com/svn/trunk/src/delegate/Delegate.m

Can only imagine what it's gonna look like then Apple add a few more flags.

# ? Jun 5, 2010 17:50

shrughes: Oct 11, 2008; (call/cc call/cc)

Here's a coding horror from the '(string)key -> (string)val "list" in C# .NEMTF' thread:

http://forums.somethingawful.com/newreply.php?action=newreply&postid=377808201#post377808201

code:

		private class Entry
		{
			public String Key { get; set; }
			public String Value { get; set; }

			public Entry(String key, String value)
			{
				Key = key;
				Value = value;
			}

			public override bool Equals(object obj)
			{
				return ((String)obj).Equals(Key);

			}

			public override int GetHashCode()
			{
				return base.GetHashCode();
			}

		}

Some human horrors there, too.

# ? Jun 5, 2010 22:35

Zombywuf: Mar 29, 2008

Flobbster posted:

I remember the good old days when I learned a lot of my programming fundamentals on an Amiga, the official method for accessing certain system data structures was to make a system call to disable multitasking, read the values, and then re-enable it.

It sure was a shock at first to move to Windows after learning so many awful (but necessary) practices like that.

I remember when I first learned programming on the Amiga, and was shocked to move to windows where I could disable multitasking without explicitly telling the operating system to do so.

# ? Jun 7, 2010 16:59

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

shrughes posted:

http://forums.somethingawful.com/newreply.php?action=newreply&postid=377808201#post377808201

Why the hell did you link to newreply.php?

# ? Jun 7, 2010 17:13

Nigglypuff: Nov 9, 2006; BUY ME BONESTORM
— OR —
GO TO HELL

Munkeymon posted:

Why the hell did you link to newreply.php?

The fragment identifier links (#) under posts are defined relative to the surrounding page, so if you copy and paste them on the reply screen, they will end up pointing there.

# ? Jun 7, 2010 17:21

b0lt: Apr 29, 2005

Nigglypuff posted:

The fragment identifier links (#) under posts are defined relative to the surrounding page, so if you copy and paste them on the reply screen, they will end up pointing there.

You mean like this except upside down?

# ? Jun 7, 2010 18:29

csammis: Aug 26, 2003; Mental Institution

Dijkstracula posted:

The real real horror is that ~~Entheogen~~ ~~Hexadecimal~~ ~~Russian Maniac~~ whatever is still posting

# ? Jun 7, 2010 19:05

Blotto Skorzany: Nov 7, 2008; He's a PSoC, loose and runnin'
came the whisper from each lip
And he's here to do some business with
the bad ADC on his chip
bad ADC on his chiiiiip

Entheogen -> Hexadecimal -> RussianManiac -> LockeNessMonster -> CrazyRRRussian

He's approaching teapot levels of money blown on the forums without anything like teapot levels of comedy

# ? Jun 7, 2010 20:39

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

b0lt posted:

You mean like this except upside down?

Yeah, suddenly I was replying to a thread, which was not at all what I was expecting to happen, but I guess it does keep the forums from changing my pointer to the last read post in the thread, so there's that?

Anyway, I just discovered something just super special here at work. There's a feature to bundle up PDFs for download as either a zip archive or one big PDF. Seems simple, right? Just find all the file names and mash then into a command to send to the appropriate binary through PHP's popen() function (this is how we do things here, which is probably also a horror). Right, except not. Instead, we've apprently decided to have the script do this in batches by redirecting back to itself via emitted JavaScript and passing the new list and state variables in a form full of hidden inputs that get POSTed back. Then, once the list is empty, the user gets a download link.

Now - shock of shocks - it "isnt working" (actual content of the complaint email) and I have to debug this :suicide:

# ? Jun 7, 2010 21:48

Athas: Aug 6, 2007; fuck that joker

I just produced this horror:

code:

if [ $(tar tf "$1"|sed 's/\/.*//g'|sort -u|wc -l) -gt 1 ]; then
    echo tarbomb!
fi

It is a snippet of Bourne shell script for checking whether a tarball ($1) extracts to more than a single file/directory.

It is very very gross, but shell scripting is a guilty pleasure for me. It's so dirty.

# ? Jun 7, 2010 21:53

Avenging Dentist: Oct 1, 2005; oh my god is that a circular saw that does not go in my mouth aaaaagh

You know what else is just as dirty and probably a lot safer? Unprotected anal sex with anonymous men in bathroom stalls.

# ? Jun 7, 2010 21:58

ShoulderDaemon: Oct 9, 2003; support goon fund; Taco Defender

Athas posted:

It is a snippet of Bourne shell script for checking whether a tarball ($1) extracts to more than a single file/directory.

I do not think your snippet works on this.

# ? Jun 7, 2010 22:00

Zhentar: Sep 28, 2003; Brilliant Master Genius

Does awful documentation count as a 'coding' horror?

I'm looking at MSDN right now for some details about Excel interop, and a few links later I'm looking at the VBA reference for Excel. MSDN is always a little hit and miss, but this is the most hosed up, rear end backwards documentation I've ever seen. Take the Workbook Object as an example. For reasons I cannot possibly imagine, they decided that rather than document the properties and methods of a Workbook, they instead should enumerate the properties of other objects that return a Workbook. A grand total of three properties or methods, out of well over a hundred, are mentioned at all, and those three are bizarrely random. Seriously, what the gently caress is this poo poo?

# ? Jun 9, 2010 20:48

Lorem ipsum: Sep 25, 2007; IF I REPORT SOMETHING, BAN ME.

Zhentar posted:

Does awful documentation count as a 'coding' horror?

I'm pretty sure everything to do with MSDN is a coding horror including the site itself.

# ? Jun 9, 2010 21:29

ColdPie: Jun 9, 2006

Lorem ipsum posted:

I'm pretty sure everything to do with MSDN is a coding horror including the site itself.

And they change it weekly. It's never better, but it's always different.

My favorite was the week where they had the function signature in different languages in this little iframe-esque tab dealer. Which was fine, except it always defaulted to the VB tab, and VB lacks a huge range of the Windows API, so it'd just say "This function is not available in Visual Basic." Great.

ColdPie fucked around with this message at 23:39 on Jun 9, 2010

# ? Jun 9, 2010 23:37

pseudorandom name: May 6, 2007

ColdPie posted:

And they change it weekly. It's never better, but it's always different.

My favorite was the week where they had the function signature in different languages in this little iframe-esque tab dealer. Which was fine, except it always defaulted to the VB tab, and VB lacks a huge range of the Windows API, so it'd just say "This function is not available in Visual Basic." Great.

It's doing that for every language right now, although that's probably just it being broken in Firefox.

# ? Jun 10, 2010 00:48

_aaron: Jul 24, 2007; The underscore is silent.

pseudorandom name posted:

It's doing that for every language right now, although that's probably just it being broken in Firefox.

Yeah, it definitely doesn't work in FF right now. Using IE Tab is an easy-enough workaround, but it's still dumb.

# ? Jun 10, 2010 05:03

Randomosity: Sep 21, 2003; My stalker WAS watching me...

Can anyone explain why PHP is like this?

php:

<?
if($undefined_var){ //Evaluates to false.
    ...
}

define('DEFINED', true);
if(DEFINED){ //Evaluates to true
    ...
}

if(NOT_DEFINED){ //Evaluates to true

}
?>

I've had this pop up in annoying circumstances twice this week. It's not major, but why in the world is PHP designed like that? Answer: PHP is a terrible language... that we all use anyway

# ? Jun 10, 2010 22:14

TOO SCSI FOR MY CAT: Oct 12, 2008; this is what happens when you take UI design away from engineers and give it to a bunch of hipster art student "designers"

Implying PHP has undergone any sort of design or planning is being awfully generous

# ? Jun 10, 2010 22:31

b0lt: Apr 29, 2005

Janin posted:

Implying PHP has undergone any sort of design or planning is being awfully generous

code:

    dbx_escape_string, escapeshellarg, escapeshellcmd, pg_escape_bytea,
    pg_escape_string, pg_unescape_bytea, addslashes, addcslashes, preg_quote,
    quotemeta, mysql_escape_string, mysql_real_escape_string,
    mysqli_real_escape_string, sqlite_escape_string

# ? Jun 10, 2010 22:33

king_kilr: May 25, 2007

mysql_real_escape_string is one of the greatest coding horrors of the modern error. Is there a fake escape string?

# ? Jun 10, 2010 22:58

tef: May 30, 2004; -> some l-system crap ->

The fake one is gpc_magic_quotes

# ? Jun 10, 2010 23:07

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Randomosity posted:

Can anyone explain why PHP is like this?

barewords

On a semi-related note, this test case illustrates a fun error I tracked down earlier today:

php:

<?
if(in_array('', explode(' ', $nonexistant_fucking_variable)))
   echo 'gently caress PHP for ever and ever - seriously';
?>

I blame PHP :colbert:

# ? Jun 10, 2010 23:18

Bhaal: Jul 13, 2001; I ain't going down alone; Dr. Infant, MD

php:

<?
$var = "Variables are case sensitive.";
$VAR = "So you won't see this unless you address $VAR";

function func($v, $s)
{
echo $v."\n";
echo $s."\n";
}

FUNC($var, 'Functions however are case insensitive.');
?>

code:

Variables are case sensitive.
Functions however are case insensitive.

php:

<?
class A 
{
  static $str = 'Oi! ';
  static function foo() {return self::$str;}
};

class B extends A
{
  static $str = 'Oh :(';

};

$php = B::foo();
$donkeyballs = ' you better not make a typo in the wrong spot.';

if( 5 > 1 )
{
   foreach( array(5) as $a )
   {
      $sucks = ' gently caress you, scope >:O ';
   }
}

echo $php . $sucks. $donkyballs;
?>

code:

Oi!  gently caress you, scope >:O

# ? Jun 10, 2010 23:20

Trammel: Dec 31, 2007; .

So, Enterprise & Agile have combined to make my life even more frustrating and slow down actual delivery of code.

Business requirements: Automatically generate a URL pointing to a product on the customers website using a per-customer pattern and a product_id provided by the customer in XML.

Enterprise solution.

a) XML product information comes in to the system via an existing perl script, writing it to a database
b) An existing database trigger will then write a row to another table
c) An existing java process will detect the new row, and fire a message over the shiny new ESB.
d) An application on the bus will be written to query a rails server for the product URL
e) A rails server & application will be created to query the first database about which pattern should be applied, apply the pattern (sprintf 'http://customer.com/product/%s', product_id) and pass it back to the process on the bus
f) The bus then writes the product information into an XML file.

BDD, TDD & Agile involvement.

The CI environment has to be created which supports
- perl originally developed on BSD back in 98.
- ruby on rails
- jboss

Each time the cucumber tests run, they fire up a rails server, fire up a jboss server (takes ~2 minutes), then executes the test.

No code gets written before the cucumber tests are written, and it takes days to setup a project which will correctly checkout all the dependancies, configure & compile them and execute a basic "Hello World" test.

Then we will write some unit tests, then some code.

Ratio of setup & testing to coding 9:1
Ratio of time taken to develop an "Enterprise" solution rather than adding a DB query & sprintf to the existing perl code: 20:1

I could go on about the ESB, why we have an ESB, the manager that introduced it & the consultants he hired to implement it, the quality of code being written for it (regular expressions in java to parse XML), and why it's now a compulsary golden hammer, but, that'd compound the horror.

Anyway, in a few days my pair might get to write some useful code.

# ? Jun 11, 2010 00:05

Kilson: Jan 16, 2003; I EAT LITTLE CHILDREN FOR BREAKFAST !!11!!1!!!!111!

Bhaal posted:

php:

<?
echo $php . $sucks. $donkyballs;
?>

code:

Oi!  gently caress you, scope >:O

What do you expect to get here? Some error about a nonexistent variable $donkyballs?

# ? Jun 11, 2010 00:47

Blotto Skorzany: Nov 7, 2008; He's a PSoC, loose and runnin'
came the whisper from each lip
And he's here to do some business with
the bad ADC on his chip
bad ADC on his chiiiiip

king_kilr posted:

mysql_real_escape_string is one of the greatest coding horrors of the modern error. Is there a fake escape string?

PHP's 'default' mysql interface is a thin wrapper over mysql's C api. Said C api originally had the mysql_escape_string function, which was found to be buggy in that it had a shitton of vulnerabilities. The mysql devs deprecated (but didn't remove iirc) the function, and added a 'fixed' mysql_real_escape_string function. The PHP devs followed this change in the mysql C api in their interface to mysql. So there are two horrors here, in addition to the rather curious choice of any informed developer to not use prepared statements (aka parameterized queries). Incidentally, if you're stuck with PHP, you can use prepared statements via the mysqli module.

# ? Jun 11, 2010 01:14

MononcQc: May 29, 2007

Randomosity posted:

Can anyone explain why PHP is like this?
php:
<?
if($undefined_var){ //Evaluates to false.
    ...
}

define('DEFINED', true);
if(DEFINED){ //Evaluates to true
    ...
}

if(NOT_DEFINED){ //Evaluates to true

}
?>
I've had this pop up in annoying circumstances twice this week. It's not major, but why in the world is PHP designed like that? Answer: PHP is a terrible language... that we all use anyway

The last one is actually because PHP treats undefined constants as string literals. NOT_DEFINED thus becomes 'NOT_DEFINED', which evaluates to true (only '' or '0' evaluate to false as far as strings go).

If you go dig into older versions of PHP, you might see arrays using literal strings as in $users[name];. This would give you the right value until the day someone defines a constant with the name 'name', where code now magically breaks somewhere down the execution path.

It's terrible on every possible point. I can't see how one could defend this.

MononcQc fucked around with this message at 01:43 on Jun 11, 2010

# ? Jun 11, 2010 01:41

Bhaal: Jul 13, 2001; I ain't going down alone; Dr. Infant, MD

Kilson posted:

What do you expect to get here? Some error about a nonexistent variable $donkyballs?

That would be pretty awesome, actually. And it can be done, but then you have to take the following into consideration:

1) Errors by default just echo out, which runs roughshod over the resulting html, so you're stuck with overloading the error handler, practically out of the box. This is more of a pain in the rear end annoyance though.

2) There is a paradigm in php of including all the possible options whether or not they're activated. This goes for string building OR math.

"Hello {$salutation} {$first_name}, thank you for your purchase of a{$n} {$product}", for instance, might have $salutation and $n completely undefined due to the data that was initially handed over. You also get frameworks that build sql queries in this manner all over.

But it's not just with strings, consider this simplified example:

php:

<?
//$sales_tax isn't defined up here because php is a slut and people are assholes

if( has_sales_tax($state) )
{
  $sales_tax = compute_sales_tax($state, $subtotal);
}

$grand_total = $subtotal + $fees + $sales_tax;
?>

If there's no sales tax then sweet! none will be added. However now our application is relying on undefined variables being permitted.

What could go wrong?

Now I'll pull a real-world example I came across recently. Take something like this:

php:

<?
$important_value = $var1 + $var2 + $var3 + $hello_i_am_var4_slightly_mispelled + $var5;
?>

I've abstracted things obviously, but this was in a large rollup operation that calculated/aggregated about 40 values and then added them into about 8 important, high visibility numbers. The high visibility numbers were $important_value and the 40 values would be the $var1, $var2, but were instead longer, like $DescriptiveSetsOfWords long.

So imagine a block of 8 similar lines of code, with one of the variables on one of the lines having a slight typo. Now imagine that adding in possibly undefined values is par for the course throughout the app, so error handling is set up to ignore that (and good luck lobbying to get that changed). And a subtle math error emerges that due to the nature of the calculations is difficult to manually backtrack, and doesn't always show up because it's commonplace to have some of those 40 values calculate to 0 anyway.

This took a while to even be discovered, then even longer to start looking in the right area due it only being noticed first in a single instance, and you have all the OTHER areas of logic, queries and data that feed into this grand totalling section which really by itself is very straightforward, "what could possibly be wrong here, it's addition and has been working so far". Yes, better testing would've caught it but it WAS being tested, by more than one person, daily; it just had a low catch rate as the bug was intermittant and deals with a fuckload of data that isn't easy to calculate by hand.

When I found the bug all I could think of is how dumb does your language have to be (and the people who adopt lovely paradigms with it) to let something as simple as a mistyped variable cause so much grief. Whereas in java or C++ or whatever, somewhere months and months into the pre-testing era a programmer would've hit compile, the compiler would've said "Hey jackass, wtf is $donkyballs?", and 5 seconds later it would've been a thing of the past.

Bhaal fucked around with this message at 02:37 on Jun 11, 2010

# ? Jun 11, 2010 02:29

king_kilr: May 25, 2007

Otto Skorzeny posted:

PHP's 'default' mysql interface is a thin wrapper over mysql's C api. Said C api originally had the mysql_escape_string function, which was found to be buggy in that it had a shitton of vulnerabilities. The mysql devs deprecated (but didn't remove iirc) the function, and added a 'fixed' mysql_real_escape_string function. The PHP devs followed this change in the mysql C api in their interface to mysql. So there are two horrors here, in addition to the rather curious choice of any informed developer to not use prepared statements (aka parameterized queries). Incidentally, if you're stuck with PHP, you can use prepared statements via the mysqli module.

Wait they left an API with KNOWN SECURITY VULNERABILITIES in? I've accused them of incompetence before, but that's just negligence in the extreme.

# ? Jun 11, 2010 03:07

BigRedDot: Mar 6, 2008

king_kilr posted:

Wait they left an API with KNOWN SECURITY VULNERABILITIES in? I've accused them of incompetence before, but that's just negligence in the extreme.

It's my foot, communist. If I want to wear gun-boots that shoot whenever I take a step, that's my own damned business. :colbert:

# ? Jun 11, 2010 03:09

Jonnty: Aug 2, 2007; The enemy has become a flaming star!

Otto Skorzeny posted:

PHP's 'default' mysql interface is a thin wrapper over mysql's C api. Said C api originally had the mysql_escape_string function, which was found to be buggy in that it had a shitton of vulnerabilities. The mysql devs deprecated (but didn't remove iirc) the function, and added a 'fixed' mysql_real_escape_string function. The PHP devs followed this change in the mysql C api in their interface to mysql. So there are two horrors here, in addition to the rather curious choice of any informed developer to not use prepared statements (aka parameterized queries). Incidentally, if you're stuck with PHP, you can use prepared statements via the mysqli module.

Was there something to stop them just making the escape function secure and asking everyone to upgrade?

# ? Jun 11, 2010 03:28

HFX: Nov 29, 2004

Jonnty posted:

Was there something to stop them just making the escape function secure and asking everyone to upgrade?

Legacy support.

# ? Jun 11, 2010 03:31

Jonnty: Aug 2, 2007; The enemy has become a flaming star!

HFX posted:

Legacy support.

Does that imply that there are programs that somehow rely on the buggy behaviour of that escape function, then?

# ? Jun 11, 2010 03:59

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 16:44

shrughes: Oct 11, 2008; (call/cc call/cc)

Jonnty posted:

Does that imply that there are programs that somehow rely on the buggy behaviour of that escape function, then?

Yes. Rasmus Lerdorf is the leader of an elite Cayman Islands-based hacking ring that created PHP as part of their scheme to water the Internet with security flaws.

# ? Jun 11, 2010 04:05

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Coding Horrors: You can gather all your technical debt into one easy framework!

«‹›1503 »