2 ms·
> no sqlite, no postgresql support? Sadly not. We haven't made the jump to PDO (yet) and still use some MySQL-specific database features, such as ordering by F
by stefdawson 6y ago
> no sqlite, no postgresql support?
Sadly not. We haven't made the jump to PDO (yet) and still use some MySQL-specific database features, such as ordering by FIELD. Once we wean the core code off that and schedule in the migration to PDO with all the prepare/execute goodness that brings, we'll support whatever database engines that PHP offer under PDO.
- e12e 6y agoFunny, I think I first heard about textpattern and PDO at approximately the same time...
- stefdawson 6y agoHaha. Yeah. Moving to PDO has been on the todo list for well over a decade and keeps getting pushed back. It's hard graft to refactor all the underlying calls and decide whether we want an ORM layer or not, and which to choose or roll-our-own, and then change all the places in the code that use the DB layer to do prepare-execute. And the plugin upheaval that rides its coattails. It's one of those things that's always overlooked in the "ain't broke so don't fix it" camp. But I know it needs doing. One day...
- e12e 6y ago> change all the places in the code that use the DB layer to do prepare-execute. Take this with a big grain of salt, but I vaguely remember tp not being great at using prepared statements / safe quoting provided by the db driver - has that been improved (if it ever was a problem)? Is it easy for plug-ins to accidentally open up to sql injection?
- stefdawson 6y agoPrepared whatnow? :) Nope, we don't use them yet. Bane of my life. We rely on all core calls and plugin authors escaping content before calling our DB layer. That has to change and will be part of the move to PDO. It's just a lot of faff work and there are always shinier things to work on. I've been secretly hoping that some kind soul will do it and issue a Pull Request. But maybe I should stop being lazy, bite the bullet and do it myself!
- e12e 6y agoThank you for your candid reply. I had a nagging memory of some troubles from bugtraq or an equivalent list (mind, many, many cms and blogs had trouble with sqli..). I am a bit surprised that hasn't been (universally, permanently) fixed in the last decade, though.