3 ms·
T_PAAMAYIM_NEKUDOTIM, mysql_real_es ape2, parse_str, etc.
by wbl 2y ago
T_PAAMAYIM_NEKUDOTIM, mysql_real_es ape2, parse_str, etc.
- duskwuff 2y ago> mysql_real_escape2 Blame MySQL for that name, not PHP. https://dev.mysql.com/doc/c-api/8.4/en/mysql-real-escape-string.html https://dev.mysql.com/doc/c-api/8.4/en/mysql-real-escape-str... (And, if you're doing modern PHP, it's just PDO->quote().)
- munk-a 2y agoI'm not certain about OP's objection but for me it's less the function name and more the terrible history of how PHP tried to automatically fix SQL injection and instead made everything a thousand times worse. If you're not using bound parameters for user data you're taking a huge risk and making your life multitudes more difficult. PHP's PDO is by far the better option at this point but it suffers from poor enough usability that I've built my own wrapper for it at two different companies.
- hparadiz 2y agoWriting a wrapper for PDO is standard operating procedure for various good reasons.
- Dylan16807 2y ago> the terrible history of how PHP tried to automatically fix SQL injection and instead made everything a thousand times worse Are you thinking of stuff like magic quotes? mysql_real_escape is not part of an automatic anything. You manually use it to quote each value.
- wbl 2y agoWhy should I blame MySQL? It's the PHP developers that decided to introduce it and not change the name, plus have several functions that don't do the right thing as well.
- cess11 2y agoThis hasn't been an issue for like fifteen years or whatever. In hindsight I think it's a good thing, it's a pea that keeps princesses at a distance from the language.