3 ms·

Will this result in more people using the prepared statements provided in PDO etc.? Then this could reduce the global number of MySQL injection attacks by a not

• duiker101 15y ago
  There is no MySQL injection attack. There is SQL injection attack. And it's not merely a problem of mysql but of how the code that uses mysql is written. And this affect all platforms. You should fix the developers to fix all sql injections.
  • qntm 15y ago
    MySQL queries constitute a signification proportion of SQL queries, and PHP's MySQL extension is responsible for a significant proportion of MySQL queries. It's not a problem of MySQL and it's not even a problem of how the PHP code that uses MySQL is written - the problem is that PHP's MySQL extension doesn't even offer a way to safely prepare a statement. "Fix the developers", in this context, would mean beating them about the head until they remember to mysql_real_escape_string() every parameter every time, and that's obviously not the right approach. A better approach is to either (1) add a mysql_prepare() function to the PHP MySQL extension, or (2) deprecate the extension in favour of one which forces or at least encourages or at least supports the use of prepared statements.