Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!news-1.dfn.de!news.dfn.de!news.informatik.hu-berlin.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Alexandra Herzog <herzog.alex@arcor.de>>
Newsgroups: comp.lang.php
Subject: Re: Prep. Statements only in mysql-i?
Date: Thu, 12 Apr 2012 14:17:21 +0200
Lines: 9
Message-ID: <9unvehFlcnU1@mid.individual.net>
References: <539265724355876611.335360herzog.alex-arcor.de@individual.de> <jm6fn9$o2l$2@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain
X-Trace: individual.net K/EtKWCO5IvRGGEoCz502QbTaNMe3jCB7FEqs3YwuDwZlMOLoK
Cancel-Lock: sha1:d5Z72kn1s17PO3SDcpOPLX0CzZI=
User-Agent: Web-News v.1.6.4 (by Terence Yim)
Xref: csiph.com comp.lang.php:5485

> Just out of curiosity, why?  Does it not work as it is?  I've always 
> been of the philosophy "don't fix what's not broke".

Well, I found out that "prepared statements" offer a good way to protect against SQL Injection Attacks. Since the best hackers are those, who do not let you realize that you've been hacked, I figured it's better to use them.

However, prepared statements seem to be unavailable in the old mysql-object. I will have to use mysql-i or PDO. Those are not supported in PHP4, so I had to upgrade to PHP5 first.
However, it was time to upgrade anyway.

Alex