Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #5487

Re: Prep. Statements only in mysql-i?

Show all headers | View raw

On 4/12/2012 8:17 AM, Alexandra Herzog wrote:
>> Just out of curiosity, why?  Does it not work as it is?  I've always
>> been of the philosophy "don't fix what's not broke".
>
> Well, I found out that "prepared statements" offer a good way to protect against SQL Injection Attacks. Since the best hackers are those, who do not let you realize that you've been hacked, I figured it's better to use them.
>
> However, prepared statements seem to be unavailable in the old mysql-object. I will have to use mysql-i or PDO. Those are not supported in PHP4, so I had to upgrade to PHP5 first.
> However, it was time to upgrade anyway.
>
> Alex

So does properly validating your data (which you should do anyway). 
Things like ensuring integer fields are integers, for instance.  And any 
strings you use need to be processed by mysql_real_escape_string().

Prepared statements are only one way to protect against SQL injection. 
But they don't replace good programming practices, and if you use good 
practices you won't be open to SQL injection whether you use prepared 
statements or other ways.

I'm not saying that prepared statements are bad.  But too often I've 
seen (even in this newsgroup) statements like the one you referenced 
from people who don't understand good programming practices.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Prep. Statements only in mysql-i? Alexandra Herzog <herzog.alex@arcor.de> - 2012-04-11 22:42 +0000
  Re: Prep. Statements only in mysql-i? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-04-12 01:16 +0200
    Re: Prep. Statements only in mysql-i? Alexandra Herzog <herzog.alex@arcor.de> - 2012-04-12 11:29 +0200
      Re: Prep. Statements only in mysql-i? Michael Fesser <netizen@gmx.de> - 2012-04-12 17:14 +0200
      Re: Prep. Statements only in mysql-i? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-04-14 08:21 +0200
  Re: Prep. Statements only in mysql-i? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-04-12 12:33 +0200
    Re: Prep. Statements only in mysql-i? Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-12 07:51 -0400
      Re: Prep. Statements only in mysql-i? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-04-12 17:22 +0200
        Re: Prep. Statements only in mysql-i? Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-12 13:16 -0400
          Re: Prep. Statements only in mysql-i? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-04-12 19:28 +0200
            Re: Prep. Statements only in mysql-i? Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-12 14:08 -0400
              Re: Prep. Statements only in mysql-i? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-04-12 20:23 +0200
                Re: Prep. Statements only in mysql-i? Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-12 16:34 -0400
            Re: Prep. Statements only in mysql-i? "Peter H. Coffin" <hellsop@ninehells.com> - 2012-04-12 13:29 -0500
      Re: Prep. Statements only in mysql-i? Adam Harvey <adam@adamharvey.name> - 2012-04-13 08:06 +0000
  Re: Prep. Statements only in mysql-i? Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-12 07:53 -0400
    Re: Prep. Statements only in mysql-i? Alexandra Herzog <herzog.alex@arcor.de>> - 2012-04-12 14:17 +0200
      Re: Prep. Statements only in mysql-i? Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-12 09:21 -0400

csiph-web