4 ms·
The answer to your question is that PHP's mysql library was pretty much alone, even at the time, in not supporting parametrization. Also your idea for automatic
by jeltz 4y ago
The answer to your question is that PHP's mysql library was pretty much alone, even at the time, in not supporting parametrization. Also your idea for automatic html escaping had been the norm in the Rails community for like 10 years and the JS community is also pretty good, but here I am unclear why not all language communities followed suit.
- setr 4y agoI don’t think I’m even in favor of automatic string escaping; string escaping generally is a ridiculous concept, for any place where we’re not intentionally mixing code & data e.g. a user-supplied regex — if it’s a user-supplied string that we intend to stuff into the middle of a regex as simple text… we should be capable of simply saying that’s what we want to do. Instead of smearing backslashes everywhere. Keep the inputs out-of-band and this whole problem doesn’t even exist as a concept
- jeltz 4y agoWhich is what the PostgreSQL protocol does. It supports sending the query and its parameters separately. HTML on the other hand does not support that.
- josteink 4y ago> The answer to your question is that PHP's mysql library was pretty much alone, even at the time, in not supporting parametrization. And at the same time everyone and their grandmother was making websites using PHP and MySQL. There should have been enough incentive to improve this early on.
- jeltz 4y agoEspecially since everyone else had solved it since before PHP even existed. This problem was invented by PHP.