101 reputation
1
bio website 127.0.0.1
location Richmond, VA
age 38
visits member for 2 months
seen Feb 17 at 23:36

OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

  1. The mysql extension is deprecated, and you are a horrible programmer if you continue to use it. There have been less creaky alternatives for years. The PDO and mysqli extensions are what decent code uses.
  2. Both new extensions provide a really cool feature: prepared statements. Used right, they nearly eliminate SQL injection vulnerabilities with very little effort.

    $db = new PDO(...);
    $stmt = $db->prepare('
        SELECT some_stuff
        FROM some_table
        WHERE some_field = ?
    ');
    
    # note the ', and how i don't have to care.
    # `execute()` will escape it automagically. 
    $stmt->execute(array("this won't break"));
    
    while ($row = $stmt->fetch()) {
        ...
    }
    

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.


This user has not answered any questions
This user has not asked any questions
This user has not participated in any tags
Stack Overflow 40,376 rep 84987
Meta Stack Exchange 1,515 rep 416
Code Review 1,469 rep 410
Programmers 634 rep 49
Super User 532 rep 29

0 Votes Cast

This user has not cast any votes