151 reputation
bio website
location Richmond, VA
age 38
visits member for 2 years, 1 month
seen Jan 19 at 6:14

OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

It's really not that hard, y'all...

$db = new PDO(...);
$stmt = $db->prepare('
    SELECT some_stuff
    FROM some_table
    WHERE some_field = ?
$stmt->execute(array('some value'));

while ($row = $stmt->fetch())

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.

This user has not asked any questions
Stack Overflow 44,788 rep 857103
Code Review 2,365 rep 618
Meta Stack Exchange 1,534 rep 516
Programmers 732 rep 410
Super User 577 rep 213

4 Votes Cast

all time   by type  
4 up 0 question
0 down 4 answer