2 ms·

not a fault of the library itself. also, mysqli_* has the same issue, was not removed

nkozyra 8y ago
It doesn't matter whose fault it is; if it provides no mechanism for prepared queries, it should be replaced. mysqli_ has prepared queries, so it offers an immediate improvement.
- creeble 8y ago
  Why couldn't the mysql_ library just have added prepared queries? I've never understood this (not a PHP programmer, just someone who has had to patch a dozen sites that were suddenly broken once).
  - lugg 8y ago
    MySQL libraries are extensions. The mysqli library was likely a full rewrite in another extension. Extensions, at least that kind, at that time, didn't use/have namespaces. Keep in mind this is a legacy code base with a function called mysql_real_escape string, like if you're at that point you're so far past gone you've lost all hope.
    - buboard 8y ago
      > like if you're at that point you're so far past gone you've lost all hope. for a 25 year library, thats not at all too bad. And even PHP developers admit that the lib was "not broken"
- teh_klev 8y ago
  You missed my point. All developers did was replace their mysql_* calls with mysqli_* calls but skipped out on the parameterising step. Sure they're using a parameterised capable API, but they're not actually parameterising their queries. In the real world dropping the mysql_* API achieved next to bugger all, we still ended up with a bunch sites with exactly the same SQL injection vulns.
  - nkozyra 8y ago
    > All developers did was replace their mysql_* They did? All of them? Nobody moved to paramaterized queries?
    - teh_klev 8y ago
      When you work for a mass market shared hoster you get to see all sorts of ugliness, dirty hacks, incompetence and just plain lazyness.
    - ars 8y ago
      New code sure? But existing code? Especially large projects? No.
      - nkozyra 8y ago
        I am 100% a LOT of projects fall under this umbrella, but: 1) this is not an argument for leaving an inferior library in the language 2) plenty of people do update their software, for old code and large projects. Why not push people toward the better library?
- reaperducer 8y ago
  mysqli_ has prepared queries, so it offers an immediate improvement. Only if they're used. If mysqli_ required prepared statements, then it would be different. But the sins that were committed with mysql_* could still be committed with mysqli_*.
  - nkozyra 8y ago
    Absolutely, the idea was to provide prepared queries while allowing people to migrate their code. The point wasn't "this fixed the injection problem" it was that it provided a solution not available for mysql_
- buboard 8y ago
  > It doesn't matter whose fault it is it does for old code. and many people prefer a website with bugs than a website that doesn't work at all. And any website that was vulnerable to mysql_* attacks should have already been hacked out of existence by now.
ddebernardy 8y ago
Unless something has changed since the early 2000s, `mysqli_` doesn't have a gazillion PHP/MySQL tutorials that are riddled with insecure code. That alone was a good reason to deprecate `mysql_`.

It doesn't matter whose fault it is; if it provides no mechanism for prepared queries, it should be replaced. mysqli_ has prepared queries, so it offers an immediate improvement.

creeble 8y ago
Why couldn't the mysql_ library just have added prepared queries? I've never understood this (not a PHP programmer, just someone who has had to patch a dozen sites that were suddenly broken once).
- lugg 8y ago
  MySQL libraries are extensions. The mysqli library was likely a full rewrite in another extension. Extensions, at least that kind, at that time, didn't use/have namespaces. Keep in mind this is a legacy code base with a function called mysql_real_escape string, like if you're at that point you're so far past gone you've lost all hope.
  - buboard 8y ago
    > like if you're at that point you're so far past gone you've lost all hope. for a 25 year library, thats not at all too bad. And even PHP developers admit that the lib was "not broken"
teh_klev 8y ago
You missed my point. All developers did was replace their mysql_* calls with mysqli_* calls but skipped out on the parameterising step. Sure they're using a parameterised capable API, but they're not actually parameterising their queries. In the real world dropping the mysql_* API achieved next to bugger all, we still ended up with a bunch sites with exactly the same SQL injection vulns.
- nkozyra 8y ago
  > All developers did was replace their mysql_* They did? All of them? Nobody moved to paramaterized queries?
  - teh_klev 8y ago
    When you work for a mass market shared hoster you get to see all sorts of ugliness, dirty hacks, incompetence and just plain lazyness.
  - ars 8y ago
    New code sure? But existing code? Especially large projects? No.
    - nkozyra 8y ago
      I am 100% a LOT of projects fall under this umbrella, but: 1) this is not an argument for leaving an inferior library in the language 2) plenty of people do update their software, for old code and large projects. Why not push people toward the better library?
reaperducer 8y ago
mysqli_ has prepared queries, so it offers an immediate improvement. Only if they're used. If mysqli_ required prepared statements, then it would be different. But the sins that were committed with mysql_* could still be committed with mysqli_*.
- nkozyra 8y ago
  Absolutely, the idea was to provide prepared queries while allowing people to migrate their code. The point wasn't "this fixed the injection problem" it was that it provided a solution not available for mysql_
buboard 8y ago
> It doesn't matter whose fault it is it does for old code. and many people prefer a website with bugs than a website that doesn't work at all. And any website that was vulnerable to mysql_* attacks should have already been hacked out of existence by now.

ddebernardy 8y ago

Unless something has changed since the early 2000s, `mysqli_` doesn't have a gazillion PHP/MySQL tutorials that are riddled with insecure code. That alone was a good reason to deprecate `mysql_`.