Sometimes, you see a code sample and you almost scroll by. "This isn't bad, I see it all the time." So it took a second glance to see the awful charm of what Henrik H found.
Henrik was asked to join a project to fix a high load website having "some issues". Here's a JavaScript tag that was included on nearly every page.
<script src="path/to/jquery.nailthumb.1.1.js">
"What?" I'm sure you wonder. "What's wrong with that? Are we stooping so low that jQuery is a WTF now?"
Let me include the output of a dir
command from the web server:
Directory of X:\wwwroot\path\to
03-08-2023 11:06 <DIR> .
03-08-2023 11:06 <DIR> ..
22-07-2023 09:26 1.609 jquery.nailthumb.1.1.css
22-07-2023 09:26 28.459 jquery.nailthumb.1.1.js
22-07-2023 09:26 629 jquery.nailthumb.1.1.min.css
22-07-2023 09:26 17.382 jquery.nailthumb.1.1.min.js
22-07-2023 09:26 1.654 jquery.nailthumb.less
That script
tag wasn't anonymized. The developer, when following the "getting started guide" saw "path/to/jquery.nailthumb.1.1.js" in the examples, and replicated the examples exactly.
That wasn't the only problem with the code- their idea of version control was naming files index.asp
, indexA.asp
, indexB.asp
, etc.
Henrik turned down the opportunity to work on this project.

This post originally appeared on The Daily WTF.