This is why you shouldn't allow URLs as a person name

I mean, allowing arbitrary characters in the name is one thing. I think I would do that as well, as there are many weird names out there.
But then actually parsing it out (or not escaping it properly), that's the real sin.
- Might be the mail client being helpful and going "hey! Thats a URL. Let me make it a link"
- At the very least remove slashes and periods from the name...

URLs as a person name
What do you mean?
- Somebody created an account at MyEpson with OP's email address and the name "GET BITCOIN NOW link", which sends a confirmation email to OP with that name. Basically it's spam using Epson as a trojan horse to get past filters.
  
  Did only a few of us miss this? Seems like it could have been explained better up front.
  
  Oh I see. Interesting...

If it doesn't exclude a URL it likely doesn't block SQL either.
- Time for the ol XKCD Little Bobby Tables attack
- These days you have to actively work against whatever framework you are using to get SQL injection to work.
  
  "framework", found your problem. Frameworks save time by ignoring how code works. Folks taught upon a Framework have no real idea what its produced code does.
- That's not how this works.
  You have a database driver that takes care of communicating with the database.
  In the bad old days (pre-early 2000s) the only way they knew how to do that was plain old SQL strings so you passed a string that contained both the data and the instructions on what to do with it.
  Now you SHOULD be writing prepared statements that contain the instructions then passing the data separately to fill in the placeholders in the prepared statement via the driver (NOT via modifying the string).
  
  // DO NOT DO THIS execute("INSERT INTO foo VALUES ('a', 'b', 'c')")
  vs
  
  // DO THIS executePrepared("INSERT INTO foo VALUES (?,?,?)", "a", "b", "c")
  
  And yet injection is still #3 in the OWASP Top 10
  
  Please explain how you remain confident of that "SHOULD" when they are not sanitizing the HTML out?

I mean, give folk a few years and it'll be something to add to the "you can't assume X about a name field" list.
- but even in the early 2000s nobody called their kid zombo.com
  
  Dweezil Zappa tells me otherwise. https://www.dweezilzappa.com/

What would be a solution? How do you know Albert/III.jr is not a valid name?
- it's a valid name but it shouldn't add the hyperlink.... wait a moment....
  *** went to check the source of the emails that i received ***
  the senders (i'm targeted by an asshole that did this on hundreds on sites) DIDN'T add any hyperlink, this is a huge security issue by gmail: they're automatically adding hyperlinks! This is very stupid, especially with the new google domains .zip and .mov. Someone sends an email like "attached there's bank-statement.zip" and then gets phished
  
  You've landed on this page because you followed a link for a .zip file. This domain was registered to prevent its misuse for potentially harmful or malicious activities.
  Well, what do ya know. There's still some good guys out there.
  
  I was just going to point out that it's the responsibility of the email service to filter that as well.
  It was a big bug ticket at my company, that our email service kept automatically turning plaintext to links like www.example.com for convenience. We couldn't fix it on our side at all.
  Edit: lol either Lemmy or my Lemmy app also turns plaintext links into real links! www.Rofl.lol
  
  Email clients and web browsers making anything that vaguely looks like a link clickable is nothing new.
- Falsehoods programmers believe about names is always a great read.
- never trust user input. the web site should be looking for and filtering this shit out.
  the other one (the submission page at the university, was right above this one in my 'all' feed) shows it better--with a full valid link in a text box. should be filtered and rejected by the form submission handler and never inserted into the database. in the case of no 'http' as part of it, links still follow a format, and those should be rejected too.
  modsecurity filters that shit out on my sites, the rules on what's allowed in a form field hardly ever get 'tested' anymore since i turned that on.
  
  Never trusting user input, sure. That, I know. And probably the university's devs do as well.
  However, it's not the university's website's fault that the email client is converting the name to a link.
  So what you're saying is, email clients should not convert link-like text to actual clickable links. Correct?

Something I just thought about for the first time: the sheer amount of spam content everywhere (website comments, mails, bots) seems to indicate that there must be ungodly amounts of money being made but I rarely see politicians actually talk about the topic and doing something against it.
Can anyone confirm/explain?
- It's cheap easy to do, requires very little actual work , and it returns some profit.
  It doesn't make a lot of money but it's more than no money at all so it is worth doing.
- One of the major issues with creating legislation to block spam emails (and spam phone calls) is that it would also impact the fundraising capabilities of political parties.
  Politicians don't talk about spam, because politicians use spam to raise money money for their campaigns.
  
  Right. The rules are different in the US. Where I live, they dont/cant do that.
- I'm not 100% sure what you're asking, but spam is generally a very low margin, very high volume kind of business. So I wouldn't assume these people are making ungodly amounts of money. I did a bit of searching and found estimates on the order of $200 million per year for spammers and spam-advertised businesses combined. Sure, it's not nothing. But on a global scale that's not necessarily ungodly amounts.
  Compare for example revenues in the illegal drug trade, which globally accounts for hundreds of billions of dollars yearly.
- Scammers exist because scams work enough to be generally profitable :(

- What's PINE?
  
  One of many old-school mail clients (unless this refers to something else)

this is how the website in question looks like btw
lol there's a whole show with crappy gifs if you continue
- I guess they need a deposit of like $100 as "inactivity fee" in order to get those $64k
  
  nope they want you to pay 6$ for "conversion fee" to convert btc to usd (probably going to ask for more and more until you give up or your wallet is drained)
- the fake chat is fucking hilarious