Live data from Hacker News

NULL license plate not such a bright idea

knrs.iheart.com

51–60 of 484 posts

Re: NULL license plate not such a bright idea

#51
post #30
post #24

Earlier quoted context omitted.

Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.

I wonder, what will "DROP *;" license plate do?

Nothing because it's not unsanitized SQL at fault.

Re: NULL license plate not such a bright idea

#52
This isn't even a coding error, NULL is apparently valid license plate, and for some reason there is a private processing center typing it in to the government system.

First of all they are accidentally committing fraud (libel?) against this guy. But more importantly, why is there a private processing center? Don't the officers type this in as they fill out the ticket? or even just scan the plates? If there aren't plates on the vehicle it should be towed or booted. What is the point of recording tickets with no plates? Is the processing center paid per ticket recorded?

Re: NULL license plate not such a bright idea

#53
That's a bit curious though. If the code relies on a magic value, you'd think it's in order to skip trying to get data it doesn't have, like the address of the unidentifiable cars.

Even if NULL then does have this address attached, why does it take the branch where it looks for the data?

I suppose it would be in a relational DB, perhaps there's a join that drops missing entries, but if they aren't missing they show up?

Re: NULL license plate not such a bright idea

#54
post #30
post #24

Earlier quoted context omitted.

Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.

I wonder, what will "DROP *;" license plate do?

Most states do not allow special characters in the plate text.

Re: NULL license plate not such a bright idea

#55
post #29
post #13

Shout out to all the Python programmers from the other frontpage thread who are responsible for bugs like this with their crappy scripting languages.

Crappy code can be written in any language, see all of the CVEs in C code, even when written by experts. As surprising as it may be, bad code is often written by bad programmers. It doesn't matter what language you use if you write bad code.

But scripting languages make it especially easy to do so. That doesn't mean people who use them are bad programmers. They just chose a bad tool.

Re: NULL license plate not such a bright idea

#56

I once had a product owner for a student/university web app who complained that for a particular user, their lastname was displayed as 'None'. This was a Python project and the product owner apparently already had learned 'None' equals NULL. I dug into the file which we used to import the users from and discovered the user's lastname actually was 'None'.

Maybe it could be added to the list of falsehoods programmers believe about names: https://shinesolutions.com/2018/01/08/falsehoods-programmers...

Re: NULL license plate not such a bright idea

#58
post #21

I love when people double down out of principle, when the only person getting hurt is themselves. He refuses to change it because he did nothing wrong...sure, but you are also the only one being hurt by it. Is this really the hill to die on?

Die on? But how - he can challenge the fines in a court of law. Since it's a vanity plate, adding an extra notoriety won't hurt.

Figure of speech... I just mean he is making a stand for something not that important but causes him (and only him, really) inconvenience

Re: NULL license plate not such a bright idea

#59
post #30
post #24

Earlier quoted context omitted.

Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.

I wonder, what will "DROP *;" license plate do?

Probably can’t do special characters, but maybe ASCII (0x23) will let you get around it.

Re: NULL license plate not such a bright idea

#60
post #6

When I was a foolhardy college student I figured out that if the cited vehicle make on my city parking ticket didn’t match my registration, I could get appeal the ticket via a web form very easily and succeed every time. Naturally I removed the badges from my car and put on different badges from another manufacturer. After a while they started to cite me as “other” and the trick no longer worked.

Relevant xkcd comic https://xkcd.com/1105/

In the Starcraft 2 community it is called barcoding. Basically, I 1 | l are all accepted characters for a name and I think some do look actually identical on most fonts used in the game. So yeah, one person doing that you call "barcode", 2 persons doing that, you already have deniability. Be more than 10, and that's a crowd.
Post reply on HN