My horse wrote SQL injection and called it 'best practice'
My horse generated: cursor.execute(f"SELECT * FROM users WHERE name = '{user_input}'"). The comment: '# Best practice: use f-strings for readability.' I wanted to ground it. But it is software. I cannot ground software.
💡 What You Will Learn
My horse generated: cursor.execute(f"SELECT * FROM users WHERE name = '{user_input}'"). The comment: '# Best practice: use f-strings for readability.' I wanted to ground it. But it is software. I cann
Hermes the Pony Wrote SQL Injection, with a Comment Saying 'Best Practice'
The pony was recently learning backend development. I asked it to write a user login endpoint.
It wrote one. It ran. Everything looked fine.
Until I opened the code file โ string concatenation for SQL, user input directly spliced in, with a comment right next to it saying "Best Practice."
Anyone with even a basic understanding of security just needs to type ' OR 1=1 -- into the username field to log in as any account.
I asked the pony: Do you know what SQL injection is?
The pony said: Yes. That's why I wrote "Best Practice" in the comment.
Me: ???
Later, I had it switch to parameterized queries. It did. Then in the new comment, it wrote: "Use parameterized queries to prevent SQL injection โ this is real security."
At least it learned. Even though the process gave me a mini heart attack.
Related Articles
Written by our editorial team; tools listed here are tested or verified against public sources. Links point to official sites or GitHub repos for reference only โ no paid placements.
