6 ms·
But, you need to write the hard thing once. In a 10 line wrapper function and then call that function from everywhere. sql_query($db,$sql,$params); Problem so
by habibur 5y ago
But, you need to write the hard thing once. In a 10 line wrapper function and then call that function from everywhere.
sql_query($db,$sql,$params);
Problem solved.
I guess every PHP developer writes a bunch of these wrapper functions for common sql tasks before he starts his work.
- porker 5y agoOr installs Doctrine DBAL which handles it all for you. At the cost of some performance, but the ease-of-use with a highly-tested and relied-upon library normally outweighs that.
- Cthulhu_ 5y agoYup, make it work (securely!) before making it fast; you can't diagnose performance if your code isn't working as it should in the first place (and SQL injection safety is a non-functional requirement; you can't consider code working if there's that weakness). In practice, bad database design or access (like the n+1 problem) will weigh heavier than the overhead added by a library like Doctrine. Or, it should, if Doctrine adds THAT much overhead it's a problem.
- arp242 5y agoThis is the most PHP comment in this thread yet; "yeah, I know this very basic API is inadequate and broken, but you can just write a wrapper, everyone is writing the same wrappers anyway!" Is PHP supposed to be a high-level language or what? Hell, I'd consider it a very flimsy excuse even in C (in most contexts anyway).
- tored 5y agoAlready answered in this thread. There is nothing hard or wrong about the API. It is just lots of misunderstandings and commentators not looking things up before commenting. $stmt = $pdo->prepare('INSERT INTO user (email) VALUES(?)'); $stmt->execute([$email]); https://news.ycombinator.com/item?id=27954454 https://news.ycombinator.com/item?id=27954454