3 ms·

I disagree. As someone who has used PDO a lot it still makes it unnecessarily hard to use parametrized queries compared to the libraries available in most other

by jeltz 5y ago

I disagree. As someone who has used PDO a lot it still makes it unnecessarily hard to use parametrized queries compared to the libraries available in most other languages, even C (at least for PostgreSQL). The pgsql library for PHP is also pretty good, better than PDO.

habibur 5y ago
But, you need to write the hard thing once. In a 10 line wrapper function and then call that function from everywhere. sql_query($db,$sql,$params); Problem solved. I guess every PHP developer writes a bunch of these wrapper functions for common sql tasks before he starts his work.
- porker 5y ago
  Or installs Doctrine DBAL which handles it all for you. At the cost of some performance, but the ease-of-use with a highly-tested and relied-upon library normally outweighs that.
  - Cthulhu_ 5y ago
    Yup, make it work (securely!) before making it fast; you can't diagnose performance if your code isn't working as it should in the first place (and SQL injection safety is a non-functional requirement; you can't consider code working if there's that weakness). In practice, bad database design or access (like the n+1 problem) will weigh heavier than the overhead added by a library like Doctrine. Or, it should, if Doctrine adds THAT much overhead it's a problem.
- arp242 5y ago
  This is the most PHP comment in this thread yet; "yeah, I know this very basic API is inadequate and broken, but you can just write a wrapper, everyone is writing the same wrappers anyway!" Is PHP supposed to be a high-level language or what? Hell, I'd consider it a very flimsy excuse even in C (in most contexts anyway).
  - tored 5y ago
    Already answered in this thread. There is nothing hard or wrong about the API. It is just lots of misunderstandings and commentators not looking things up before commenting. $stmt = $pdo->prepare('INSERT INTO user (email) VALUES(?)'); $stmt->execute([$email]); https://news.ycombinator.com/item?id=27954454 https://news.ycombinator.com/item?id=27954454
tored 5y ago
You can do parametrized queries in two lines of code with PDO. I wouldn't classify that as "unnecessarily hard", sure you could split in half to one line of code, for that you need to write your own wrapper function.

by jeltz 5y ago

habibur 5y ago

But, you need to write the hard thing once. In a 10 line wrapper function and then call that function from everywhere. sql_query($db,$sql,$params); Problem solved. I guess every PHP developer writes a bunch of these wrapper functions for common sql tasks before he starts his work.

porker 5y ago
Or installs Doctrine DBAL which handles it all for you. At the cost of some performance, but the ease-of-use with a highly-tested and relied-upon library normally outweighs that.
- Cthulhu_ 5y ago
  Yup, make it work (securely!) before making it fast; you can't diagnose performance if your code isn't working as it should in the first place (and SQL injection safety is a non-functional requirement; you can't consider code working if there's that weakness). In practice, bad database design or access (like the n+1 problem) will weigh heavier than the overhead added by a library like Doctrine. Or, it should, if Doctrine adds THAT much overhead it's a problem.
arp242 5y ago
This is the most PHP comment in this thread yet; "yeah, I know this very basic API is inadequate and broken, but you can just write a wrapper, everyone is writing the same wrappers anyway!" Is PHP supposed to be a high-level language or what? Hell, I'd consider it a very flimsy excuse even in C (in most contexts anyway).
- tored 5y ago
  Already answered in this thread. There is nothing hard or wrong about the API. It is just lots of misunderstandings and commentators not looking things up before commenting. $stmt = $pdo->prepare('INSERT INTO user (email) VALUES(?)'); $stmt->execute([$email]); https://news.ycombinator.com/item?id=27954454 https://news.ycombinator.com/item?id=27954454

tored 5y ago

You can do parametrized queries in two lines of code with PDO. I wouldn't classify that as "unnecessarily hard", sure you could split in half to one line of code, for that you need to write your own wrapper function.