Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      Error’d: Pickup Sticklers

      September 27, 2025

      From Prompt To Partner: Designing Your Custom AI Assistant

      September 27, 2025

      Microsoft unveils reimagined Marketplace for cloud solutions, AI apps, and more

      September 27, 2025

      Design Dialects: Breaking the Rules, Not the System

      September 27, 2025

      Building personal apps with open source and AI

      September 12, 2025

      What Can We Actually Do With corner-shape?

      September 12, 2025

      Craft, Clarity, and Care: The Story and Work of Mengchu Yao

      September 12, 2025

      Cailabs secures €57M to accelerate growth and industrial scale-up

      September 12, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Using phpinfo() to Debug Common and Not-so-Common PHP Errors and Warnings

      September 28, 2025
      Recent

      Using phpinfo() to Debug Common and Not-so-Common PHP Errors and Warnings

      September 28, 2025

      Mastering PHP File Uploads: A Guide to php.ini Settings and Code Examples

      September 28, 2025

      The first browser with JavaScript landed 30 years ago

      September 27, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured
      Recent
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: The Last Last Name

    CodeSOD: The Last Last Name

    July 3, 2025

    Sometimes, you see some code which is perfectly harmless, but illustrates an incredibly dangerous person behind them. The code isn’t good, but it isn’t bad in any meaningful way, but it was written by a cocaine addled Pomeranian behind the controls of a bulldozer: it’s full of energy, doesn’t know exactly what’s going on, and at some point, it’s going to hit something important.

    Such is the code which Román sends us.

    <span class="hljs-keyword">public</span> <span class="hljs-built_in">static</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">registerUser</span>(<span class="hljs-params"><span class="hljs-variable">$name</span>, <span class="hljs-variable">$lastName</span>, <span class="hljs-variable">$username</span>, ...</span>) </span>{
        <span class="hljs-comment">// 100% unmodified first lines, some comments removed</span>
        <span class="hljs-variable">$tsCreation</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">DateTime</span>();
        <span class="hljs-variable">$user</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>();
          
        <span class="hljs-variable">$name</span> = <span class="hljs-variable">$name</span>;
        <span class="hljs-variable">$lastname</span> = <span class="hljs-variable">$lastName</span>;
        <span class="hljs-variable">$username</span> = <span class="hljs-variable">$username</span>;
           
        <span class="hljs-variable">$user</span>-><span class="hljs-title function_ invoke__">setUsername</span>(<span class="hljs-variable">$username</span>);
    	<span class="hljs-variable">$user</span>-><span class="hljs-title function_ invoke__">setLastname</span>(<span class="hljs-variable">$lastname</span>);
    	<span class="hljs-variable">$user</span>-><span class="hljs-title function_ invoke__">setName</span>(<span class="hljs-variable">$name</span>);
    	<span class="hljs-comment">// And so on.</span>
    }
    

    This creates a user object and populates its fields. It doesn’t use a meaningful constructor, which is its own problem, but that’s not why we’re here. We’re here because for some reason the developer behind this function assigns some of the parameters to themselves. Why? I don’t know, but it’s clearly the result of some underlying misunderstanding of how things work.

    But the real landmine is the $lastname variable- which is an entirely new variable which has slightly different capitalization from $lastName.

    And you’ve all heard this song many times, so sing along with the chorus: “this particular pattern shows up all through the codebase,” complete with inconsistent capitalization.

    [Advertisement]
    Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleCisco scores a perfect 10 – sadly for a critical flaw in its comms platform
    Next Article AssetCool raises £10M Series A to scale robotic grid upgrade technology globally

    Related Posts

    News & Updates

    Building personal apps with open source and AI

    September 12, 2025
    News & Updates

    What Can We Actually Do With corner-shape?

    September 12, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    Build an AI-powered document processing platform with open source NER model and LLM on Amazon SageMaker

    Machine Learning

    I took over 500 photos with the Samsung S25 Ultra and Oppo Find X8 Ultra – the winner is very clear

    News & Updates

    Critical 9.8 CVSS Flaw: Unpatched PayU CommercePro Plugin Allows Admin Account Takeover!

    Security

    ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

    Development

    Highlights

    Critical Teleport Vulnerability Let Attackers Remotely Bypass Authentication Controls

    June 23, 2025

    Critical Teleport Vulnerability Let Attackers Remotely Bypass Authentication Controls

    Summary
    1. CVE-2025-49825 allows attackers to remotely bypass Teleport’s authentication controls, affecting multiple versions of the secure access platform.
    2. Teleport has issued security updates for …
    Read more

    Published Date:
    Jun 23, 2025 (2 hours, 45 minutes ago)

    Vulnerabilities has been mentioned in this article.

    CVE-2025-49825

    3,500 Websites Hijacked to Secretly Mine Crypto Using Stealth JavaScript and WebSocket Tactics

    July 21, 2025

    Dutch NCSC Confirms Active Exploitation of Citrix NetScaler CVE-2025-6543 in Critical Sectors

    August 12, 2025

    VESDA Aspirating Smoke Detection System Setup Cost in India | Xtralis Price & Installation

    May 14, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.