Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #14002

Re: str_replace does not like empty quotes

Show all headers | View raw

On 6/22/2014 7:20 PM, Geoff Muldoon wrote:
> jstucklex@attglobal.net says...
> 
>>> Of course, bind variables are massively better, but I doubt that 
> Richard 
>>> is up to knowing about them yet.
> 
>> One opinion.  But bound values have their problems, also.  They are
>> neither better nor worse than properly escaping values.  Just another
>> way of doing things.
> 
> Hmm, I've never really found any signifcant down-side to using bind 
> variables if they are used corrctly, so I'd appreciate any links you 
> might have.
> 
> IMHO three of the main pluses are:
> 
> a) A strong (but not totally foolproof) barrier against SQL injection 
> attacks.
> 
> b) On certain platforms (perhaps on Oracle more so than MySQL, etc.) the 
> ability to shared pool cache or soft-parse rather than hard-parse a 
> particular execution plan, often significantly increasing performance 
> when querying the same columns from the sames tables.
> 
> c) Parameter input values do not NEED to be properly escaped.
> 
> http://en.wikipedia.org/wiki/Prepared_statement
> 
> GM
> 

Performance, for one.  Bound values require at least one extra call to
the libraries (for the PREPARE).

Additional calls are required to bind numeric values.  Of course they
are also required for string variables, but since strings need to
otherwise be processed through mysql_real_escape_string(), that's a push.

Additionally, values should always be validated before being used in a
mysql request anyway.

The extra processing can be excessive in a busy site.  Of course, if
you're only getting 100 hits/day, it's not a problem.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

str_replace does not like empty quotes richard <noreply@example.com> - 2014-06-19 19:33 -0400
  Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-19 20:09 -0400
  Re: str_replace does not like empty quotes Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2014-06-19 20:11 -0400
    Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-19 20:55 -0400
    Re: str_replace does not like empty quotes Doug Miller <doug_at_milmac_dot_com@example.com> - 2014-06-20 03:23 +0000
    Re: str_replace does not like empty quotes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-06-20 09:31 +0200
  Re: str_replace does not like empty quotes Arno Welzel <usenet@arnowelzel.de> - 2014-06-20 03:19 +0200
    Re: str_replace does not like empty quotes Arno Welzel <usenet@arnowelzel.de> - 2014-06-20 03:21 +0200
      Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-19 21:33 -0400
        Re: str_replace does not like empty quotes Arno Welzel <usenet@arnowelzel.de> - 2014-06-20 04:06 +0200
          Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-19 22:26 -0400
    Re: str_replace does not like empty quotes richard <noreply@example.com> - 2014-06-19 22:13 -0400
      Re: str_replace does not like empty quotes Doug Miller <doug_at_milmac_dot_com@example.com> - 2014-06-20 03:26 +0000
      Re: str_replace does not like empty quotes Arno Welzel <usenet@arnowelzel.de> - 2014-06-20 11:01 +0200
        Re: str_replace does not like empty quotes Arno Welzel <usenet@arnowelzel.de> - 2014-06-20 11:02 +0200
          Re: str_replace does not like empty quotes Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-20 15:38 +0000
      Re: str_replace does not like empty quotes Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-20 15:32 +0000
  Re: str_replace does not like empty quotes Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-20 01:59 +0000
  Re: str_replace does not like empty quotes Doug Miller <doug_at_milmac_dot_com@example.com> - 2014-06-20 03:25 +0000
  Re: str_replace does not like empty quotes Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-06-20 16:10 +1000
    Re: str_replace does not like empty quotes Christoph Michael Becker <cmbecker69@arcor.de> - 2014-06-20 13:48 +0200
      Re: str_replace does not like empty quotes Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-20 15:40 +0000
      Re: str_replace does not like empty quotes Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-06-22 10:05 +1000
        Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-21 20:08 -0400
          Re: str_replace does not like empty quotes Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-06-23 09:20 +1000
            Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-22 20:44 -0400
              Re: str_replace does not like empty quotes Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-06-23 16:33 +1000
                Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-23 09:07 -0400
                Re: str_replace does not like empty quotes Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-06-24 12:34 +1000
                Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-23 23:07 -0400
                Re: str_replace does not like empty quotes Doug Miller <doug_at_milmac_dot_com@example.com> - 2014-06-24 11:12 +0000
                Re: str_replace does not like empty quotes Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-24 08:01 -0400
  Re: str_replace does not like empty quotes Olaf Schmitt <thesys@gmx.de> - 2014-06-24 08:13 +0200
    Re: str_replace does not like empty quotes Arno Welzel <usenet@arnowelzel.de> - 2014-06-24 10:44 +0200
      Re: str_replace does not like empty quotes Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-24 18:48 +0000
        Re: str_replace does not like empty quotes Christoph Michael Becker <cmbecker69@arcor.de> - 2014-06-24 21:53 +0200
          Re: str_replace does not like empty quotes Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-06-24 22:08 +0200

csiph-web