Completeness of Answers

Question

I had a general question that's come from comments on my answers from experienced users on the site, see User defined password at registration - registration email sends auto generated pass and Using jQuery to delete data stored in wp_options. After reading How To Answer, my understanding was that we should answer the specific question, rather than providing ready to go copy/paste code, not that the two are mutually exclusive.

In the ajax example, @brasofilo raised a very good point, the code will simply be copy/pasted, and the suggested edits from the three experienced users reflected that. But how far does that go? In the first example, the asker posted a question about sending a user selected password via email. The answer answers that question, but as @t31os pointed out, the code is inherently unsafe as it doesn't contain sanitization or even check that the correct form fields were filled out, much less a nonce check, etc. But how far does that go? Should I be creating the initial form for the asker as well? Am I presuming too much in assuming that most developers follow best practices with form submission, db interaction sanitization and any framework specific security considerations (I guess I am)?

I guess I could just use some guidance as to how much is too much or too little when answering the question. I'd like to be, "doing it right." Thanks for any input.

Answer 1

My take is that while it is best to give a complete answer, and that is largely the point, as I understand it, of the Stack Exchange network-- not to provide tech support exactly but to provide working solutions to particular common problems. But that isn't always possible or practical. We work for free here and some of us actually work for real. And sometimes the questions do not have detail that allows for a complete answer.

Any answer that gets the asker going in the right direction is helpful, but do try to mention any limitations, assumptions or simplifications in your answer.

https://stackoverflow.com/questions/how-to-answer

If I know there is a problem or a potential problem I will explicitly state my concerns, offer warnings, and if possible point to the steps to ameliorate the problems.

Still, effort should be made to post code is plausibly safe, at least, as evidenced by the recent attacks on WordPress sites. People do just paste code blindly.

Answer 2

Looking at the two specific examples you gave:

1. The Ajax question was borderline over-broad, and would probably have been better-served with a tighter scope
2. In both cases, the solution to the underlying problem can get lost in the details if too much "production-ready" code is added to the answer. Often, in such situations, I will add prose, or inline PHP comments to the code, indicating where data sanitization would be required, but omitted from the answer for brevity/clarity.

There is a fine balance between providing a thorough, complete answer and work for me for free on over-broad questions. If you find that your answer starts to involve more than about three steps, and if those steps are considerably unrelated to each other, that's often a signal that the scope of the original question needs to be tightened.

Likewise, there is a fine balance between using quality "example"/"proof-of-concept" code, and losing the actual answer to the actual question in the details of "production-ready" code. If more than a quarter of your example code (or, if a significant number of comments to your answer) involves corollary issues such as data sanitization, that's probably a good indication that those corollary issues should be separated from the crux of the example code.

It is a good thing to ensure due diligence that code that we know will end up as copy pasta is as quality/safe as possible, but that diligence should not distract from the primary purpose of the code: to answer the posed question.

Answer 3

I read this thread with interest as I am new to the answering here and sometimes have trouble distinguishing between comments and answers. I just read the (Privileges) Comment Article

I made certain my (incomplete) answer didn't do any of these things:

• Request clarification from the author;
• Leave constructive criticism that guides the author in improving the post;
• Add relevant but minor or transient information to a post (e.g. a link to a related question, or an alert to the author that the question has been updated).

And the answer gets moved to a comment. Isn't peer reviewing fun? LOL

Answer 4

I've just had an answer deleted and moved to a comment (here), but to me it feels like I clearly answered both parts of the original question, i.e. I gave a suggestion for a plugin (that does exactly what the OP needs), and advised that the region & status should be taxonomies. I'm not really that bothered either way, but I am curious why this is seen as a comment rather than an answer?