161 reputation


OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

It's really not that hard, y'all...

$db = new PDO(...);
$stmt = $db->prepare('
    SELECT some_stuff
    FROM some_table
    WHERE some_field = ?
$stmt->execute(array('some value'));

while ($row = $stmt->fetch())

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.

Top Tags (3)

Score 6
Posts 1
Score 6
Posts 1
Score 6
Posts 1

Top Posts (1) All Questions Answers | Votes Newest

Badges (4)

Bronze 4