Re: PHP sucks!! - was: persistent db connections in PHP

On 6/17/07, PFC <lists@peufeu.com> wrote:
>  I either use pg_query_params() which automagically handles all quoting,
> or an ORM which does the same.
>  There is no reason to include strings in SQL statements except laziness.
>  MySQL does not have a mysql_query_params() for PHP, so you have to write
> one, it's pretty simple.


Take your pick:

- Quotemeta
- Addslashes
- Htmlentities($string, 'utf-8')
- Magic_quotes in the INI
- Anti-XSS code (several available online)


> Python's (and perl) strength in this respect is that they make it easier
> to use the safe solution, ie, query( "sql with ? or $1 or %s", arg, arg, arg )


$sql = '"select column from table where field = '%s';
$sql = sprintf($sql, $submittedvariable);
..


> PEAR::DB is horrendous.
>

And hugely unnecessary.

EP