I recently finished a practicum for which I desperately need a recommendation from. However when I was working on the code for the public face web-portal I noticed many sql injection possibilities and as well as other things.
What bothers me is the complete ignorance of the indevidual managing the code. He wrote much of the code and is completely unaware of what SQL is supposed to be used for. In that manner he also doesn't know how to properly protect against SQL injection and the like. While I was working for the individual I tried to push him in the right direction of looking and seeing how broken the system was. But I really need a good recomendation for a job and didn't wish to upset him. The office is also a very close-knit office and there was no-one I felt would understand the severe need for code review.
Why I feel that this issue must be addressed is because they system was for a School district to manage student records very personal student records. We (the developers including another student) had access to a clone of the live database for testing purposes and there my little brother is set to enroll in that school district next year.
The lead developer is somewhat good at programming but with the lack of understanding regarding SQL and relation databases the system will be exploited and most likely within the next year as it's being rolled out district wide.
I really feel I should have said something to someone. :( Besides phoning up the supervisor and asking him to do something what can I legally do. Can I phone the RCMP (I'm Canadian) and ask them to investigate (I know that's dumb but this is verging on criminal negligence).