joindin/joind.in — pull request #601 by dstockto (2012-12-03 04:10:21+00:00)
Title: If username is provided but blank, return empty comment structure.

JOINDIN-139

I believe this fixes the issue described in JOINDIN-139. When I was in there and testing with the apitester though, it appears that in order for the username to properly be read, it must be passed in quoted. It also means that this API is SQL injection vulnerable. I don't know if the iPhone app is passing in quoted values or not but I didn't want to change the behavior (I put the 'u' in the last word but it underlined it, sorry :) ) without having a bit of discussion about it first. I don't want to break the iPhone app by making it escape any provided quotes.

Please advise on that.