4 ms·
You missed my point. All developers did was replace their mysql_* calls with mysqli_* calls but skipped out on the parameterising step. Sure they're using a par
by teh_klev 8y ago
You missed my point. All developers did was replace their mysql_* calls with mysqli_* calls but skipped out on the parameterising step. Sure they're using a parameterised capable API, but they're not actually parameterising their queries.
In the real world dropping the mysql_* API achieved next to bugger all, we still ended up with a bunch sites with exactly the same SQL injection vulns.
- nkozyra 8y ago> All developers did was replace their mysql_* They did? All of them? Nobody moved to paramaterized queries?
- teh_klev 8y agoWhen you work for a mass market shared hoster you get to see all sorts of ugliness, dirty hacks, incompetence and just plain lazyness.
- ars 8y agoNew code sure? But existing code? Especially large projects? No.
- nkozyra 8y agoI am 100% a LOT of projects fall under this umbrella, but: 1) this is not an argument for leaving an inferior library in the language 2) plenty of people do update their software, for old code and large projects. Why not push people toward the better library?