3 ms·
> But that's not a thing for 15 years or more? PDO was added around 2005 Ex-shared hosting bod here, who had the joy of managing our PHP environments :( Sadly
by teh_klev 7y ago
> But that's not a thing for 15 years or more? PDO was added around 2005
Ex-shared hosting bod here, who had the joy of managing our PHP environments :(
Sadly in the real world, even after the great big (and pointless) act of deprecating and removing the mysql_* library, naive developers (and experienced ones that should've know better) just moved onto mysqli_* or PDO and still used string concatenation with raw inputs, instead of learning how to parameterise their queries.
Used to drive me flippin' nuts.
- ivanhoe 7y ago> naive developers (and experienced ones that should've know better) just moved onto mysqli_* or PDO and still used string concatenation with raw inputs, instead of learning how to parameterise their queries. True, I stand corrected, I've just checked and Wordpress still does it just like that: https://github.com/WordPress/WordPress/blob/master/wp-includes/wp-db.php#L2023 https://github.com/WordPress/WordPress/blob/master/wp-includ...