In Hungary the unified school administration systems source code gets leaked (and also the personal data of 4 million students, teachers and parents), feast year eyes on what an oligarchs friends company can develop with measly 50 million EUR+another 30 for hosting and upkeep.

It's full of quality code like this.

The lead software tester was a daughter of another friend with whopping 2 years of experience (and a non-stem degree).

They didn't have 2fa for anything, they got access to one of the developers outlook email+password through social engineering and got access to EVERYTHING.

the whole sourcecode: t.me/sawarim

I want to thank your countrymen for paying for this @UraniumDonGER:marseythumbsup:

200
Jump in the discussion.

No email address required.

can you or someone else post :marseymaxrockatansky: the file or link it or somewhere where :marseydrama: you don't need a telegram :marseytelegram: account because telegram :marseytelegram: is a cancer

Jump in the discussion.

No email address required.

jc is back :marseyjam:

Jump in the discussion.

No email address required.

:marseylove:

Jump in the discussion.

No email address required.

Are you the one who filmed sucking peepee in a public bathroom and posted it on the original drama site?

Jump in the discussion.

No email address required.

no that was joan :joanmarsey:

Jump in the discussion.

No email address required.

Oh sorry for the wrong accusation

Jump in the discussion.

No email address required.

Wasn't that JWG?

Jump in the discussion.

No email address required.

Just click on preview channel, scroll up and it's there in a .zip.

Jump in the discussion.

No email address required.

if you click it it just :marseyblops2chadcel: goes :marseycoleporter: in a loop

Jump in the discussion.

No email address required.

There's only a github account listed but there's nothing in it for now: https://github.com/sawarimhacker

:#marseyrain:

welcome back tho queen :marseyxoxo:

scratch that i'm r-slurred:

https://anonfiles.com/tcFdRbG5y8/kreta_src_zip

https://archive.org/details/kreta_src_202211

Jump in the discussion.

No email address required.

thanks :marseyschizochadthankscapylove: :marseylove:

Jump in the discussion.

No email address required.

lol oh dear.

I worked for a company that paid some douche $40k for a simple WordPress site with a few customizations he outsourced to sexy Indian dudes. It's when I realized that I could r*pe corporate wallets too and needed to get in on this grift.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp

Jump in the discussion.

No email address required.

It's sad: HR is unable to hire good codecels because the best ones have the personality of a brick, and most HRcels will refuse to hire someone without a bit of charisma, so they end up hiring the people who manage to fudge and bullshit their way in but can't do any actual work.

Jump in the discussion.

No email address required.

Just another reason to abolish HR

Jump in the discussion.

No email address required.

:#marseymanysuchcases:

This is true in almost every white collar profession.

Jump in the discussion.

No email address required.

Its not HR's fault that nobody wants to work with a sperg.

Jump in the discussion.

No email address required.

my old company suffered from this. they actually had a policy, even when hiring engineers (including software engineers), to not have any technical component to the interview, it was entirely behavioral.

needless to say there were a bunch of actual r-slurs there who had no idea what they were doing. for all you codecels out there, as a quick example, over 3/4ths of the software engineers had literally never even heard of "git" before. no, I'm not kidding, this isn't an exaggeration, I was fricking floored when they were all like "... but tempest, what's 'git'?"

the jap team was the worst. those dumbasses didn't use any source code management at all and just copied the "repo" (read: just a directory with files) around each others' computers using windows shared drives. the manager's ""repo"" was the primary.

Jump in the discussion.

No email address required.

This is why I started focusing on bullpooping as soon as I could code at a junior level

Jump in the discussion.

No email address required.

Sounds like they got high on their own supply. I can play a sad tone on the world's 2nd smallest violin for em.

Jump in the discussion.

No email address required.

He posted about that on reddit, had like 6 high paying jobs and was making almost a million per year selling sexy Indian dude spaghetti code

Jump in the discussion.

No email address required.

@Aevann

Please implement this immediately

Jump in the discussion.

No email address required.

we already prevent sql injection

Jump in the discussion.

No email address required.

'; DROP TABLE users; -- take that ;)

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

rip

Jump in the discussion.

No email address required.

Yes but this “””method””” is funnier

Jump in the discussion.

No email address required.

it's literally more effort :marseymissing: to do it that way so no we didn't sadly

Jump in the discussion.

No email address required.

yeah but did you implement THIS?

Jump in the discussion.

No email address required.

Oh wow coders quick get in on this! Here's a chance to tell everyone that you're a coder and could do better than this or relate it to some shitty experience from your own life!

Fricking wow. Big deal. You know how to defensively build apps to avoid sql injection but are you getting paid by government money to not do that? Ha. Thought not. So who's really the stupid one?

Jump in the discussion.

No email address required.

Literally every thread on drama about coding. Me thinks coders only appear competent when commenting on other people's code but the moment they actually have to do any work themselves they all reveal themselves to be drooling r-slurs (except for our lovely admin codecels ofc :marseyworried:)

Jump in the discussion.

No email address required.

Nitpicking code mistakes from the sidelines without context and smugly responding with handwavey "solutions" is one of the basic requirements for being a developer.

Jump in the discussion.

No email address required.

You don’t need context to recognize r-slur code.

Jump in the discussion.

No email address required.

I'm sitting here staring at it thinking "what's the big deal? Looks like a pretty good input sanitization function to me :marseythumbsup:".

Jump in the discussion.

No email address required.

  1. Rolling your own function to do this is a bad idea (biggest issue)

  2. Runtime efficiency sucks

  3. Code is not very maintainable (minor concern, however the code is overall rather amateurish)

There would be no better time to use a REGEX. The entire method could be reduced to two lines, and would be faster.

Jump in the discussion.

No email address required.

  1. just charge more to make it lmao

  2. charge more to run it

  3. charge more to maintain it

sound like wins to me.

2. has the bonus that you can shave off some of the time later if they come to you asking you to make it faster. It's perfect.

Jump in the discussion.

No email address required.

remember put Thread.Sleep randomly in your code :marseycapytrans: so you can just :marseyblops2chadcel2: remove it and give :marseyitsover: multisecond performance boosts

Jump in the discussion.

No email address required.

I'd rather have a few more lines of readable code, than a regex that is a pain in the butt to look at.

Jump in the discussion.

No email address required.

>runtime efficiency

Eh, not really. The .NET CLR optimizes this kind of stuff away.

Jump in the discussion.

No email address required.

It is pretty nonsensical. First it looks for the first " " in the string, and then removes everything after that space. e.g. "testtest testetste" would get turned into "testtest ". then they trim it to "testtest". If they had just removed the +1, they wouldn't have to trim it.

So this function by defaults rejects anything beyond the first space, which is most likely not what would expect from a function called "PreventSQLInjection".

Now because of that it is literally impossible the string would ever contain stuff like " or ", which works in their favor, because they are not even checking for case sensitivity. However you could just use non space whitespace, like \n or \t and it would still work. So so far this hasn't actually done anything.

Then replacing " or " with nothing, is actually a pretty horrible way to handle it, because " o or r " would just get turned into " or ", but again thats irrelevant because it is impossible for there to be a space to begin with.

Then there might be some unicode character that is seen as a ' by the database, but not as a ' by c#

Jump in the discussion.

No email address required.

There really is a lot of layers to the crappiness of this code, lol. The more I look at it the more I can find.

So this function by defaults rejects anything beyond the first space, which is most likely not what would expect from a function called "PreventSQLInjection".

I thought that was a double space, rofl. What were they even trying to do with that?

Jump in the discussion.

No email address required.

They're missing UNION, which is pretty common in SQL injection attacks. There are probably others missing, too.

Jump in the discussion.

No email address required.

Sure, and they only have AND and and, not AnD or aNd. But that shouldn't matter if everything is quoted, no?

Jump in the discussion.

No email address required.

and they only have AND and and, not AnD or aNd

Lol, I didn't even think of those. This is also another bad code example. The String.Replace() method has a way to toggle case sensitivity, iirc.

But that shouldn't matter if everything is quoted, no?

IF the output has been single-quoted within the code invoking the method. Any dev using this method that forgets to do so has potentially created another vulnerability. From a design standpoint, it's bad (IMO) because it splits the responsibility of security between this method and the dev invoking it. If the dev invoking it had instead just used SqlCommand, it would not only be secure but also involve less code overall. Apparently there's some other shit you can do, too.

All in all, it's a very bad idea to try to scratch-build security if reliable solutions already exist (i.e. not some homebrew solution on a personal GitHub repo).

Jump in the discussion.

No email address required.

Apparently there's some other shit you can do, too.

The alternative method assumes you replace ' with ''. The OP code just erases it.

Jump in the discussion.

No email address required.

There's a few extra methods described in there but I only scanned the page before pasting the link. I see that one answer talked about "SQL smuggling" involving screwing with Unicode translation, which I wouldn't have considered without looking this up. However, it looks like using String.Replace() might take care of that, according to the answer.

Jump in the discussion.

No email address required.

The String.Replace() method has a way to toggle case sensitivity, iirc.

Don’t even need to do worry about sensitivity if you just use .toLowerCase(name). So anything put in that input line is always lowercase when being passed in. If you need the first character to be uppercase for output you can format later.

Also Java should have a built in anti sql injection function, like there’s built in hashing in pretty much every backend usable language now, or just regex it yourself.

Jump in the discussion.

No email address required.

Don’t even need to do worry about sensitivity if you just use .toLowerCase(name).

I actually said the same thing in my comment at first but I went back and changed it b/c the method returns the altered user input, which means lowercasing or uppercasing it could return the user input with alterations not intended for sanitation.

Jump in the discussion.

No email address required.

Funnily enough all those cases are covered because before searching for disallowed tags they truncate the text to only stuff before the first space (and including that first space for some unfathomable reason) so you're never gonna match " AND " because it literally starts with a space, it's just an extra run through the string at that point that takes up time and does nothing else.

Jump in the discussion.

No email address required.

No need to be jealous that some RDramatards have a useful skillset.

Jump in the discussion.

No email address required.

This is like C# bootcamp code lol

Jump in the discussion.

No email address required.

no, this is what fidesz does to your codebase

![](/images/16681060180223262.webp)

Jump in the discussion.

No email address required.

Even my password is(was) more secure

Jump in the discussion.

No email address required.

Not even that. ADO.NET has parameterized queries built in and has been a core library in .NET since its initial release. This is probably some JS bootcamp code monkey who can't even bother to search "C# sql injection".

Jump in the discussion.

No email address required.

The head developer had 8 years of experience at Microsoft and 4 at Wise.

They just really don't care. Try explaining 3 million fidesz voters who can't even write their name down why this is embarassing. They got 30 million euros every year. For this.

Jump in the discussion.

No email address required.

:#marseylaugh:

Holy shit, that's bad.

They just really don't care.

What makes this funnier is that using the SqlCommand class would have likely been easier and less work, too. This seems like a case of not reviewing what the jr devs are doing and just letting them throw dogshit into the main branch as long as it runs.

Jump in the discussion.

No email address required.

They got 30 million euros every year. For this.

How do I get myself this job? For just half a million a year I can promise code twice the quality of this.

Jump in the discussion.

No email address required.

Be friends with a crackpot dictator or corrupt authoritarian.

Jump in the discussion.

No email address required.

Did the head developer actually work at Microsoft, or were they just dash-trash?

Jump in the discussion.

No email address required.

ground breaking

:#marseynotes:

Jump in the discussion.

No email address required.

Dramamins could learn from this...

Jump in the discussion.

No email address required.

Holy shit that's bad. Wow.

Is this why euro devs are generally paid much less?

Jump in the discussion.

No email address required.

Euros are paid less because the government takes an higher protection fee from their salaries compared to the Land of Freedom

Jump in the discussion.

No email address required.

This is Hungary. They have a considerably lower tax rate than most European countries. Their government is just incompetent.

Jump in the discussion.

No email address required.

Yeah, but that's not the only thing that gets deducted from our salaries, the total is around 37%. For Comparison Norway is 46% and they also get functional healthcare for it and not the world highest VAT (27%), while most consumers goods have another 5-10% slapped on top of that for whatever stupid reason the government comes up with.

But at least this year so far our pensioners got their pensions raised 3 times and poors got a lot of gibs for being faithful Fidesz voters, just try not to think about the +22% inflation lib:platysalute:

Jump in the discussion.

No email address required.

Seems similar to how I'm told PiS runs poland, with endless gibs for unemployed moms and pensioners :marseythinkorino:

To think PiS and Fidesz are the ones to bring down the EU lol

Jump in the discussion.

No email address required.

Wait aren't you hungarian? Why is your name szechenyi? This is cultural appropriation:marseyraging:

Jump in the discussion.

No email address required.

Darn, didn't mean to hoodwink anyone :marseybeanpensive:

I guess I feel a kindred spirit in Szechenyi, a cautious liberal reformer who saw the revolution abandon him as too hesitant and not radical enough, and then lived long enough to see counter revolution dunk on his country.

Jump in the discussion.

No email address required.

Seems like the play fir a eurodev is to be unemployed and write code that enriches you personally

Jump in the discussion.

No email address required.

That sounds all good, but we are world leaders in sales tax with 27%

Just imagine that 25 of the 100 sheckels I pay for my morning bagel goes to the government

Jump in the discussion.

No email address required.

Pfft, just eat less.

Jump in the discussion.

No email address required.

Of course Hungary has low taxes, how else would there be room for bribes?

Jump in the discussion.

No email address required.

Thats not true lol. Im hungarian and 45% of what my employee pays me gets shafted

They paid 900,00 huf last month and I got 520,000 cash in hand

Jump in the discussion.

No email address required.

:#marseykneel:

I've already been corrected by other RDramatards but you honor me with your reply.

Jump in the discussion.

No email address required.

This is what happens when a country drives all their programming socks enthusiasts away. SMH :marseydisagree:

Jump in the discussion.

No email address required.

I hope you're not using "protection" in bad faith because that might give the impression that minorities and marginalised folx need "protection" when it's actually just being a decent human being. If anything those fees need to be raised.

Jump in the discussion.

No email address required.

Trans Guns Matter!

Jump in the discussion.

No email address required.

They’re paid substantially less before you even factor in protection fees. Euro society is so stifled they actively seek to prevent anything resembling technological progress so theres little to no demand for engineers or scientists.

Hence the obsession with shit like trains and rowhouses and hatred of cars and suburban style SFH. They literally refuse to move beyond millennia old lifestyles at the expense of their own comfort and happiness.

Jump in the discussion.

No email address required.

>They literally refuse to move beyond millennia old lifestyles at the expense of their own comfort and happiness.

t. lives in the United states of crumbling infrastructure

Jump in the discussion.

No email address required.

Chicago has some of the shittiest infra in the country and its still better than anything in Europe. Imagine your roads being so fragile semis can’t drive on them lmao fricking euros

Jump in the discussion.

No email address required.

t. has to filter his drinking water like he lives in an african village

Jump in the discussion.

No email address required.

^ 40% take home after taxes on wagie pay

Jump in the discussion.

No email address required.

:#marseycope::#marseycope::#marseycope:

Jump in the discussion.

No email address required.

Hop on your train Euro wagie remember cars are for the upper class only :marseysmug:

Jump in the discussion.

No email address required.


Link copied to clipboard
Action successful!
Error, please refresh the page and try again.