Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Ode To W3Schools

jonkuperman.com

Post reply on HN
Print view View original

31–40 of 66 posts

Re: An Ode To W3Schools

#31

Post by pretoriusB »

dorward wrote: post #18

Their PHP+MySQL tutorial has an SQL injection vulnerability in every example that takes user input. It never mentions SQL injection as a possible problem and it never covers any of the techniques needed to defend against it. In my book, that's unforgivable and they won't get any slack from me until they fix it.

That happens in 99% of PHP+MySQL tutorials out there...

And looking a little closer, even in the most reputable sources, you can found XSS and especially CSRF vulnerabilities aplenty.

People should not get security advice from a beginner's tutorial anyway, even if it covered XSS, it would have tons of other problems.

Re: An Ode To W3Schools

#32

Post by pretoriusB »

I find the argument about wiki-fying bizarre. Do people really want W3Schools wikified?

In my experience, wiki programming/documentation resources, with a handful of exceptions, are horrible, abandoned places.

Most are are made into wikis because they didn't have enough content in the first place, and there was some misguided notion that the users will just "jump in" and create it.

Re: An Ode To W3Schools

#33

Post by bbotond »

dorward wrote: post #18

Their PHP+MySQL tutorial has an SQL injection vulnerability in every example that takes user input. It never mentions SQL injection as a possible problem and it never covers any of the techniques needed to defend against it. In my book, that's unforgivable and they won't get any slack from me until they fix it.

Very true. It amazes me that in 2012, the code in 8 out of 10 PHP/MySQL questions on StackOverflow is still vulnerable to SQL injection. Sometimes people post code that is running on real, production web sites that handle credit card data. They even give you the URL. It's super easy to crack any of them - hell, you can see exactly what you have to do in the ugly 500-line monstrosity they posted. Any resource that is dedicated to education and teaches web development should take SQL injection very seriously. There is no excuse for not doing so.

Re: An Ode To W3Schools

#34

Post by bbotond »

pretoriusB wrote: post #31
dorward wrote: post #18

Their PHP+MySQL tutorial has an SQL injection vulnerability in every example that takes user input. It never mentions SQL injection as a possible problem and it never covers any of the techniques needed to defend against it. In my book, that's unforgivable and they won't get any slack from me until they fix it.

That happens in 99% of PHP+MySQL tutorials out there... And looking a little closer, even in the most reputable sources, you can found XSS and especially CSRF vulnerabilities aplenty. People should not get security advice from a beginner's tutorial anyway, even if it covered XSS, it would have tons of other problems.

But those tutorials should include a warning like "what we teach here is enough for you to build a nice dog house but using the same techniques on a sky scraper will surely lead to disaster" - and then give you resources to educate yourself further.

Re: An Ode To W3Schools

#35

Post by Jare »

collypops wrote: post #26
manaskarekar wrote: post #11

Earlier quoted context omitted.

I think the reason a lot of newbies start with them is because of a straight to the point easy to read format. They may not be the most accurate or comprehensive, but the low barrier to entry is EXACTLY what newbies are looking for.

I disagree. The reason a lot of newbies start with W3Schools is because they're the plague of Google search results. Popularity isn't everything. If it was, we'd all be promoting Nicki Minaj as the definitive source of quality music.

That may be why they start, but nobody would come back if the site wasn't so terribly useful, concise and easy to navigate.

Re: An Ode To W3Schools

#37

Post by saraid216 »

camus wrote: post #30

simple : MDN is crap, not SEO friendly and not synthetic. For instance , i want a fast sum up of regexps with Javascript : the W3School shows a short table with the main keywords , that's all i need. It's like a cheat sheet. MDN is verbose ,badly written , accurate maybe, but i dont want 50 exemples on Proxies or Generators , i dont care about them. Now i agree , the name is confusing , there are errors , but until f…

I was going to suggest that you contribute, and then I looked at your idea of whitespacing English and decided not to.

Re: An Ode To W3Schools

#38

Post by jiggy2011 »

dorward wrote: post #18

Their PHP+MySQL tutorial has an SQL injection vulnerability in every example that takes user input. It never mentions SQL injection as a possible problem and it never covers any of the techniques needed to defend against it. In my book, that's unforgivable and they won't get any slack from me until they fix it.

The problem is that these tutorials were written a looong time ago when the default was to have magic quotes switched on which has probably saved thousands of newbie developers apps from being SQL injected. The default is now off.

Of course magic quotes caused problems with excessive escaping in DB fields leading to some developers explicitly de-escaping values before adding them to the DB.

Re: An Ode To W3Schools

#39

Post by camus »

saraid216 wrote: post #37
camus wrote: post #30

simple : MDN is crap, not SEO friendly and not synthetic. For instance , i want a fast sum up of regexps with Javascript : the W3School shows a short table with the main keywords , that's all i need. It's like a cheat sheet. MDN is verbose ,badly written , accurate maybe, but i dont want 50 exemples on Proxies or Generators , i dont care about them. Now i agree , the name is confusing , there are errors , but until f…

I was going to suggest that you contribute, and then I looked at your idea of whitespacing English and decided not to.

Perfect whitespacing doesnt make a doc readable obviously, so no i'm definetly not interested.

Re: An Ode To W3Schools

#40

Post by ZeroMinx »

nthitz wrote: post #29
simonsarris wrote: post #3

I disagree and I don't think he really responded to any of the criticisms, just sort-of acknowledged them. > They Appear Affiliated With The W3C > For those in the know the W3C is the World Wide Web Consortium, it is an international organization that governs the web. W3Schools rides off the notoriety of that name despite being unaffiliated. Is that really a complaint? How many _Java_Script developers are out there t…

Same goes for Stella Artois, owned by Anheuser-Busch

I've never met anyone thinking Stella Artois was a microbrew. Interesting to learn this about Blue Moon though.
Post reply on HN