3 ms·
Because, as the article states, people aren’t using prepared statements. Instead, they pass f-strings because they’re more convenient.
by scott_w 2y ago
Because, as the article states, people aren’t using prepared statements. Instead, they pass f-strings because they’re more convenient.
- hedgehog 2y agof strings are syntax rather than a type, the resulting templates look like a reasonable way to specify a prepared statement.
- vultour 2y agoExcept to maintain backwards compatibility we're probably going to get new methods that only accept templates, completely circumventing any effort to stop people passing in strings. Prepared statements were the recommended way to run SQL queries when I was starting with PHP 15 years ago, anyone writing code vulnerable to SQL injection at this point should not be writing code.
- scott_w 2y agoWell yes but the alternative is to never make language improvements because legacy code exists.