Re: Yet another reason to use DBI placeholders

I doubt you want your customers greeted as "Mr. !#@$%^" and allowed to buy an $80,000 widget for $5.

If they get to save $79995, then they'll probably be willing to put up with being called some pretty rude (or punctuated) things.

Of course, calling your female customers "Mr" is another issue entirely...

--
use JAPH;
print JAPH::asString();

Comment on Re: Yet another reason to use DBI placeholders

Replies are listed 'Best First'.
Re^2: Yet another reason to use DBI placeholders by mr_mischief (Monsignor) on Dec 16, 2008 at 16:03 UTC
If the customer gets to save $79995, they might be happy, but the sales staff and accountants won't be. Not only are openly rude names an issue and gender as you said. Misspelling a name, using a nickname for someone who prefers their proper given name, disallowing punctuation in punctuated names, or truncating a common name because your DBA didn't think about how many characters to use for a field are pretty disrespectful, too. "Mrs. Jones-O'Reilley" doesn't want to be greeted as "Mr. Jones-O'Reilley", but neither does she want "Mrs. O'Reilley", "Mrs, Jones-OReilley", "Mrs. Jones-O'Riley", or "Mrs. Jones-O'Re". My first name is Christopher, and I can tell you how frustrating it can be to call somewhere that the clerk insists the account holder's name is "Christophe" because the DBA thought ten characters was plenty. Let's not even start on how often my last name's spelling is "corrected" as if I filled it out incorrectly myself and the customer service representative knows better. As frustrating as this kind of oversight is in customer service, I'm not sure what attacker would be quite so subtle as to only change those things.	[reply]

Replies are listed 'Best First'.

Re^2: Yet another reason to use DBI placeholders
by mr_mischief (Monsignor) on Dec 16, 2008 at 16:03 UTC

"Mrs. Jones-O'Reilley" doesn't want to be greeted as "Mr. Jones-O'Reilley", but neither does she want "Mrs. O'Reilley", "Mrs, Jones-OReilley", "Mrs. Jones-O'Riley", or "Mrs. Jones-O'Re". My first name is Christopher, and I can tell you how frustrating it can be to call somewhere that the clerk insists the account holder's name is "Christophe" because the DBA thought ten characters was plenty. Let's not even start on how often my last name's spelling is "corrected" as if I filled it out incorrectly myself and the customer service representative knows better. As frustrating as this kind of oversight is in customer service, I'm not sure what attacker would be quite so subtle as to only change those things.

[reply]