Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
An UPDATE without a WHERE, or something close to it (rachelbythebay.com)
5 points by l0b0 on Oct 13, 2021 | hide | past | favorite | 2 comments


My career in IT (at the uni support desk) started with me screwing up an UPDATE. The colleague setting up the internal system had typed in something close to `UPDATE users SET password = hash("`, and asked me to type in the password I wanted (this was the early 2000s and an internal system, so basically standard practice). In an effort to be "helpful" I finished the statement with `");` and pressed Enter. And that's how everyone had to reset their password.


That was one of my first thoughts when I learned sql. If there is no condition on modifying operation, it would be nice if it required ALLROWS in place of WHERE. Like UPDATE t SET x=1 ALLROWS and DELETE FROM t ALLROWS. Or at least some dummy condition like WHERE 1=1.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: