Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • My Thought is, regardless of plain text passwords which is a massive no no. If you have changed all queries to PDO and are using prepared statements, unless there is a change your email ect section. They should be unable to execute an SQL query to change email addresses ect Commented Feb 4, 2014 at 18:26
  • 1
    I didn't change /all/ queries to PDO, sorry, I changed the ones we found were being affected by SQL injections. Commented Feb 4, 2014 at 18:31
  • Would a better solution all round be to add a PDO class and then implement that class through out the site? then think about hashing passwords, and using a salt however this maybe a little time consuming as you state it is a "Legacy" app i'd assume it has a fair few users. Commented Feb 4, 2014 at 18:36
  • 5
    I'd say revise your 'what can happen' to 'what has happened' since they've been hacked already and the users credentials have been released into the hands of hackers. Commented Feb 4, 2014 at 18:48
  • It seems your question is just about communication with your client. Honestly, you should know your contact persons and how to approach them. Keeping calm is always a good strategy, just point the risks out to your client and let him decide about the urgency. Commented Feb 4, 2014 at 18:54