3 ms·
Ask HN: SQL; to prepare or not to prepare, is this blog correct?
I just ran into this blog post https://joshduff.com/2011-05-10-why-you-should-not-be-using-mysqli-prepare.md
This goes against everything I've been taught. I've always thought you should always use prepared statements for security. While it's possible to make sure you escape well, your best to rely on prepared statements doing that for you.
But is this guy correct? Is the performance hit a big enough problem?
- tenken 9y agoI wouldn't trust anything written in 2011, I'd research newer analysis before coming to an opinion. There are many details to cover such as emulated prepares, or not emulated prepares -- for some examples of more recent opinions on the matter: https://stackoverflow.com/q/10113562/1491507 https://stackoverflow.com/q/10113562/1491507
- borplk 9y agoIt's garbage, ignore the post.