3 ms·
Prepared statements are amazing. Found out about them very soon after I started programming (incidentally my first language was PHP), and switched to PDO right
by vultour 9y ago
Prepared statements are amazing. Found out about them very soon after I started programming (incidentally my first language was PHP), and switched to PDO right away. This was years ago, I don't understand how people are still using the deprecated and insecure mysql_* functions, you can still find them all over SO and my university "web" class was teaching them as well...
- plug 9y agoYou'll be glad to hear that they've finally been removed since PHP 7.0 so slowly but surely they're being consigned to history. And there seems to be much better awareness about the perils of mysql_* functions amongst PHP devs these days. However, 5.6 is still in security support until 31st December 2018, so all that bad advice on SO and elsewhere is still relevant and lurking, waiting to be found by inexperienced devs.
- flukus 9y agoAs other people have noted, prepared statements aren't a security panacea, and string concatenation you do in the query can be vulnerable.