Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #12124 > unrolled thread

PHP sql entry is a godaweful mess

Back to article view | Back to comp.lang.php

Contents

  PHP sql entry is a godaweful mess <bored@now.com> - 2013-12-04 11:35 +0000
    Re: PHP sql entry is a godaweful mess Tim Streater <timstreater@greenbee.net> - 2013-12-04 12:37 +0000
    Re: PHP sql entry is a godaweful mess Jerry Stuckle <jstucklex@attglobal.net> - 2013-12-04 08:52 -0500
      Re: PHP sql entry is a godaweful mess bill <william@TechServSys.com> - 2013-12-05 06:13 -0500
        Re: PHP sql entry is a godaweful mess [OT] adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2013-12-05 13:13 +0000
    Re: PHP sql entry is a godaweful mess Arno Welzel <usenet@arnowelzel.de> - 2013-12-04 17:15 +0100
    Re: PHP sql entry is a godaweful mess John Smith <johnsmithjsm@live.com> - 2014-01-06 23:17 -0500

#12124 — PHP sql entry is a godaweful mess

I've just decided to update some code so updated myself with the docs
for mySQL entry cleaning and frankly I am totally confused.

Can someone point to a very clear and unambigous instruction
as to how to safely enter data into a mysql database?
Because I doubt thats even possible with PHP.

We have to contend with stripslashes, magic_quotes, magic_quotes_sybase
mysql_escape_string, mysql_real_escape_string  and more...

and now they say mysql_real_escape_string is deprecated in favour
of a mysqli requirement. And dont get mne started on idiotic OOP with 
PHP.

Is there a full time team of monkeys sitting at keyboards
ensuring sql entry will never be secure?

As for mysqli and its unnecessarily obtuse syntax... well I'll be 
looking for alternatives.

PHP is a set of script language bodges pretending to be a programming 
language - its time it was cleaned up or people moved on or
data security can never happen.

Its become a dangerous joke.



 

[toc] | [next] | [standalone]

#12125

In article <MPG.2d0923e0848f8339896b9@news.virginmedia.com>,
<bored@now.com> wrote:

> PHP is a set of script language bodges pretending to be a programming 
> language - its time it was cleaned up or people moved on or
> data security can never happen.
> 
> Its become a dangerous joke.

Ha ha ha ha ha. Now piss off.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#12127

On 12/4/2013 6:35 AM, bored@now.com wrote:
>
>
> I've just decided to update some code so updated myself with the docs
> for mySQL entry cleaning and frankly I am totally confused.
>
> Can someone point to a very clear and unambigous instruction
> as to how to safely enter data into a mysql database?
> Because I doubt thats even possible with PHP.
>
> We have to contend with stripslashes, magic_quotes, magic_quotes_sybase
> mysql_escape_string, mysql_real_escape_string  and more...
>
> and now they say mysql_real_escape_string is deprecated in favour
> of a mysqli requirement. And dont get mne started on idiotic OOP with
> PHP.
>
> Is there a full time team of monkeys sitting at keyboards
> ensuring sql entry will never be secure?
>
> As for mysqli and its unnecessarily obtuse syntax... well I'll be
> looking for alternatives.
>
> PHP is a set of script language bodges pretending to be a programming
> language - its time it was cleaned up or people moved on or
> data security can never happen.
>
> Its become a dangerous joke.
>
>
>
>
>


PHP is an OK language.  While I also have some issues with it, I don't 
have anywhere near the disdain you seem to have.

stripslashes() was a (very) old way of handling things; magic quotes 
similar.  Fortunately, the PTB have fixed those problems; magic quotes 
are no longer recommended and stripslashes() pretty much gone by the 
wayside.  mysql_real_escape_string() is much better; it has the added 
advantage of being charset sensitive and will properly escape strings in 
non-latin1 charsets.

Getting rid of the mysql_xxx extension was a stupid idea, IMHO.  Some 
people have claimed it's because they MySQL 'C' functions they wrap 
around have been deprecated, but there is no indication of that in the 
documentation.  Maybe they just didn't want to maintain two sets of code 
for the same database.

I do think the mysqli_xxx() functions are an improvement over the 
mysql_xxx functions.  It does give you the *option* of using OO 
techniques (which I generally prefer), but they also have non-OO 
equivalents.  Typically it's only a matter of changing 
mysql_xxx(parameters) to mysqli_xxx($link, parameters);

And safely inserting into a MySQL database is also very easy and similar 
to any database.  You need to validate all values, including type and 
actual value (which needs to be done for ANY database).  Process ALL 
string variables (including things such as the WHERE clause) with 
mysqli_real_escape_string().  Alternatively, you can use prepared 
statements and bind the values (in mysqli).

PHP, like any language, has matured and changed.  They all have had 
changes as they have grown.  While I think early PHP was pretty much 
crap, I could say the same thing about C, for instance.  And don't get 
me started on FORTRAN II from the 60's!

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#12148

On 12/4/2013 8:52 AM, Jerry Stuckle wrote:
> While I think early PHP was pretty much crap, I could say the
> same thing about C, for instance.  And don't get me started on
> FORTRAN II from the 60's!

and RPG
and COBOL

bill

[toc] | [prev] | [next] | [standalone]

#12151 — Re: PHP sql entry is a godaweful mess [OT]

bill <william@TechServSys.com> wrote:

> On 12/4/2013 8:52 AM, Jerry Stuckle wrote:
> > While I think early PHP was pretty much crap, I could say the
> > same thing about C, for instance.  And don't get me started on
> > FORTRAN II from the 60's!
> 
> and RPG
> and COBOL

ALGOLW was good.


-- 
~ Adrian Tuddenham ~
(Remove the ".invalid"s and add ".co.uk" to reply)
www.poppyrecords.co.uk

[toc] | [prev] | [next] | [standalone]

#12131

Am 04.12.2013 12:35, schrieb bored@now.com:

> I've just decided to update some code so updated myself with the docs
> for mySQL entry cleaning and frankly I am totally confused.
> 
> Can someone point to a very clear and unambigous instruction
> as to how to safely enter data into a mysql database?
> Because I doubt thats even possible with PHP.

It is - just do NOT use mysql but mysqli or PDO.

> We have to contend with stripslashes, magic_quotes, magic_quotes_sybase
> mysql_escape_string, mysql_real_escape_string  and more...

No - you don't have to.

See:

<http://php.net/manual/en/class.mysqli.php>
<http://www.php.net/manual/en/mysqli.prepare.php>
<http://php.net/manual/en/book.pdo.php>
<http://php.net/manual/en/pdo.prepare.php>

> As for mysqli and its unnecessarily obtuse syntax... well I'll be 
> looking for alternatives.

Obtuse syntax? Why?

Maybe you got confused by the fact, that mysqli comes in two flavors:
Procedural - to make it easier to migrate existing code from mysql - and
object oriented.

See <http://php.net/manual/en/mysqli.quickstart.dual-interface.php>



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#12561

On Wed, 4 Dec 2013 11:35:40 -0000, <bored@now.com> wrote:

>
>
>I've just decided to update some code so updated myself with the docs
>for mySQL entry cleaning and frankly I am totally confused.
>
>Can someone point to a very clear and unambigous instruction
>as to how to safely enter data into a mysql database?

Please use mysqli package with bound variables. Please refer to the
manual.

>Because I doubt thats even possible with PHP.

It is absolutely possible. All the sql injection and related are
solely the programmer(s) fault. 

>As for mysqli and its unnecessarily obtuse syntax... well I'll be 
>looking for alternatives.

What is exactly obtuse there?

John

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web