5 ms·

PHP7 has removed a lot of the old cruft and made some small improvements to PHP's idiomatic syntax. One great example is the removal of the mysql_real_escape_s

PHP7 has removed a lot of the old cruft and made some small improvements to PHP's idiomatic syntax. One great example is the removal of the mysql_real_escape_string function. http://php.net/manual/en/function.mysql-real-escape-string.php http://php.net/manual/en/function.mysql-real-escape-string.p... Another is finally giving us a null coalescing operator, which is a solution for a constant pain point in dealing with raw PHP POST and GET parameters. The full "new features" list of PHP7: http://php.net/manual/en/migration70.new-features.php http://php.net/manual/en/migration70.new-features.php The change log of PHP7+: http://php.net/ChangeLog-7.php http://php.net/ChangeLog-7.php

iopq 10y ago
They removed mysql_real_escape_string function so that you can use mysqli_real_escape_string http://php.net/manual/en/mysqli.real-escape-string.php http://php.net/manual/en/mysqli.real-escape-string.php
- greyman 10y ago
  No, you use PDO::quote().
  - CiPHPerCoder 10y ago
    No, you use $pdo->prepare("SELECT id FROM foo WHERE bar = ? AND baz = ?") ->execute([$baz, $qux]); ...while taking care to set PDO::ATTR_MODE to PDO::ERRMODE_EXCEPTION and PDO::ATTR_EMULATE_PREPARES to false when your PDO object is initialized. https://github.com/paragonie/airship/blob/8b7edde11b5b57fcb4b46024ca2227fd3cd4fc28/src/Engine/Database.php#L40-L47 https://github.com/paragonie/airship/blob/8b7edde11b5b57fcb4... See also: http://stackoverflow.com/a/12118602/2224584 http://stackoverflow.com/a/12118602/2224584
    - roblabla 10y ago
      This is the problem I have with PHP. 15 ways to do something seemingly simple, and only one obscure way is correct (What's PDO::ATTR_MODE ?) And why does PDO try to emulate prepares ?
      - stephenr 10y ago
        That was 4 ways. The documentation identify what the options do.
    - stephenr 10y ago
      Named parameters are much simpler to use IMO.
      - CiPHPerCoder 10y ago
        Simpler? No. Easier? Yes.

iopq 10y ago

They removed mysql_real_escape_string function so that you can use mysqli_real_escape_string http://php.net/manual/en/mysqli.real-escape-string.php http://php.net/manual/en/mysqli.real-escape-string.php

greyman 10y ago
No, you use PDO::quote().
- CiPHPerCoder 10y ago
  No, you use $pdo->prepare("SELECT id FROM foo WHERE bar = ? AND baz = ?") ->execute([$baz, $qux]); ...while taking care to set PDO::ATTR_MODE to PDO::ERRMODE_EXCEPTION and PDO::ATTR_EMULATE_PREPARES to false when your PDO object is initialized. https://github.com/paragonie/airship/blob/8b7edde11b5b57fcb4b46024ca2227fd3cd4fc28/src/Engine/Database.php#L40-L47 https://github.com/paragonie/airship/blob/8b7edde11b5b57fcb4... See also: http://stackoverflow.com/a/12118602/2224584 http://stackoverflow.com/a/12118602/2224584
  - roblabla 10y ago
    This is the problem I have with PHP. 15 ways to do something seemingly simple, and only one obscure way is correct (What's PDO::ATTR_MODE ?) And why does PDO try to emulate prepares ?
    - stephenr 10y ago
      That was 4 ways. The documentation identify what the options do.
  - stephenr 10y ago
    Named parameters are much simpler to use IMO.
    - CiPHPerCoder 10y ago
      Simpler? No. Easier? Yes.