Source
r/programminghorror•
codingsewer

Exhumed from the dark days of the stupid ages

I just ran across this code while going through a sql injection testing report. The code is probably over 10 years old now yet still hanging around our system because management are code hoarders (but wait, someone might use it!).

<cfquery datasource="#DSN#" name="siteQuery">
select title,body,site_id,link_text,key_words 
from pages 
where id = #cgi.query_string#
</cfquery>

"Just take whatever is in the browser and shove it right into your sql that runs on every page... what could go wrong?!"

Posted Mar 12, 2014, 7:28 PM UTC

3712
remy_porter•

I was horrified by the third character. Cold Fusion? NOOOOOOOOOOOO.

9
LordFraggington•

but wait, someone might use it!

Never, EVER the phrase you want to hear.

Seriously, code gets updated for exactly this reason. I mean, its one thing to have a deprecated feature from a previous version of a company's product left around so they can update it/create a new version, but in my experience (still in college with 1 internship under my belt) there's almost no other scenario that calls for it. I've worked on too many projects/helped people with their code where the number of class files - and the class files themselves - where simply massive because they didn't want to get rid of any of the old code they used before in case the new code didn't work, or would leave it commented out in the file long after it became useless/irrelevant. Is there any practical reasons for doing this? I really do want to know (and not just rant).

5
jmcs•

Because managers don't know what source control management is and most devs don't know how to use it properly any way.

7
codingsewerOP•

Personally, I'd rather take a scorched earth policy with code like this. Delete it and if someone complains restore from a backup. But I've worked in places where management doesn't understand version control and files become huge because they 're storing the history in commented code. Plus, there's huge momentum behind "this works right now and we don't have the time to update it so just code around the terrible bits."

It really is code hoarding. They keep junk around because it's scary to actually delete things or otherwise deal with it.

3
chishiki•

I keep old code because it works and I'm lazy. True story.

3
adelle•

I hoard code too. If I write a neat piece of code that turns out to be unnecessary, I put it in a separate folder. I even keep that folder in source control with the actual project, and I can see from the history when it was taken out of the project and why.

Keeping commented out code in the project is retarded, even for code hoarding purposes.

2
mrcactus28•

I personally prefer a Stalinist purge policy (it's in git, right?) too, but...

  1. You discover that your experienced coworkers don't actually know how to use version control

  2. At my current job, there's never been any version control on non-production-critical scripting and programming, and any 'reuse' has been with scripts emailed back and forth. From what I gather, years ago, management became convinced that "developer time is expensive" so any time spent on "non-core competency" was wasted, i.e., you got fired. Now I just stash shit into folders in my home directory for day-to-day use and I don't share any of it.

1
ragingRobot•

You use cold fusion? We used that at my old job and everyone hated it lol. It took us so long to convince them to let us switch to something else.

3
codingsewerOP•

Funny, I've never really had a problem with ColdFusion but then again I'm used to its oddities.

2
Raticide•

I knew it would be bad when I saw <cf. You'd be better off with PHP.

1
codingsewerOP•

I understand the hate toward CF but I disagree that PHP would magically prevent tragedies such as this.

5
lhgaghl•

the main reason coldfusion was made was to create vulnerable websites

4
[deleted]•

[deleted]

1