Zenilogix

@candied_orange I stand corrected. Language-independent.

dd-MMM-yyyy e.g. 24-Sep-2018 is unambiguous. It's also easier to read and understand (if you're English). It shares the drawback with all year-last formats of being unsortable as a string. yyyyMMdd happens to be sortable and also culture independent by virtue of the numerically represented month.

I learned source control concepts long ago using centralized tools like Microsoft Visual Source Safe and svn. I then started at a company using git and using paired programming (religiously); we used a GUI tool called Git Extensions (roughly similar to sourcetree). I initially found it bewildering partly because of unfamiliar concepts and terminology and sometimes clashes in terminology between systems. At some point, I had an "A Ha!" moment, and it all became clear. Your team just needs to persevere and get over the hump. Maybe pairing those who "get it" with those who haven't yet might help.

Bear in mind: screening and filtering only protects you from the threats you already know about; it does nothing to protect from the threats you haven't thought of. Parameterized queries are a pretty good defense against any injection threat, whether you know about it or not.

Prepared statements / parameterized queries existed as a performance measure. They just happen to be immune to SQL injection attacks. In the early days of web programming, books contained nice simple examples of how to write SQL queries. For the sake of simplicity in presentation, they demonstrated the literal string approach. Unfortunately, such examples formed the basis of a lot of production code. Only as web programming newbies worked their way up the learning curve did they realize the vulnerability of their code to SQL injection.