101 reputation
3
bio website 127.0.0.1
location Richmond, VA
age 39
visits member for 3 years, 8 months
seen Jun 24 at 13:54

OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

It's really not that hard, y'all...

$db = new PDO(...);
$stmt = $db->prepare('
    SELECT some_stuff
    FROM some_table
    WHERE some_field = ?
');
$stmt->execute(array('some value'));

while ($row = $stmt->fetch())
{
     ...
}

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.


This user has not answered any questions
This user has not asked any questions
This user has not participated in any tags
Stack Overflow 47,975 rep 965114
Code Review 2,605 rep 719
Meta Stack Exchange 1,589 rep 617
Programmers 762 rep 410
Super User 607 rep 314

12 Votes Cast

all time   by type  
12 up 4 question
0 down 8 answer