Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112695
MIME-Version: 1.0
References: <CAGBsUrei=az9TERLhZukybY1hH1wVq6adEc=3UHrCcjHdtc5QQ@mail.gmail.com>
In-Reply-To: <CAGBsUrei=az9TERLhZukybY1hH1wVq6adEc=3UHrCcjHdtc5QQ@mail.gmail.com>
Date: Thu, 31 Dec 2020 11:28:21 +0000
Message-ID: <CAFv4g+E9pS1SJPFF6h+EF69y4xjkqG1y2egb34qfb=eP0-_=jw@mail.gmail.com>
To: Kamil Tekiela <tekiela246@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000075807c05b7c0ecbf"
Subject: Re: [PHP-DEV] Mysqli improvements
From: craig@craigfrancis.co.uk (Craig Francis)

--00000000000075807c05b7c0ecbf
Content-Type: text/plain; charset="UTF-8"

Hi Kamil,

I like these proposals, especially error reporting, which I've got caught
out with before:

https://bugs.php.net/bug.php?id=78932

As to "add bind-in-execute to mysqli", by passing an array of parameters to
mysqli_stmt::execute(), this is something I'd really like to see.

I just wonder if we could take it a little further, so a query can be
executed with parameters with one function/method? which is what I was
proposing last week:

https://news-web.php.net/php.internals/112618
https://marc.info/?l=php-internals&m=160898181628407

Only because I'd like the "right way" to also be the easiest/fastest way,
on the basis that developers just want to get the job done, and the
simplest way should be the best way.

Today, I still see a lot of this:

    $name = ($_GET['name'] ?? '');

    $sql = 'SELECT * FROM user WHERE name LIKE "' . $name . '"';

    $result = $mysqli->query($sql);

    while ($row = $result->fetch_assoc()) {
    }

Yes, not even using error prone (flawed) escaping - something we can
address in "phase 2" :-)

I suspect (heavy sarcasm implied) it's because it's so much easier than
this monstrosity:

    $name = ($_GET['name'] ?? '');

    $sql = 'SELECT * FROM user WHERE name LIKE ?';

    $statement = $mysqli->prepare($sql);
    $statement->bind_param('s', $name);
    $statement->execute();

    $result = $statement->get_result();

    while ($row = $result->fetch_assoc()) {
    }

So I really like how you've avoided the difficult bind_param() method, with
it's annoying $types string, and pass-by-reference issue, so it looks a bit
more like:

    $statement = $mysqli->prepare($sql);
    $statement->execute([$name]);

    $result = $statement->get_result();

    while ($row = $result->fetch_assoc()) {
    }

I really hope you can do this - as it allows the developer to re-issue the
prepared statement by calling execute() again.

But I'd still like to go a little bit further, so we can get $result in a
single function/method call, like the original (flawed) approach:

    $result = $mysqli->execute($sql, [$name]);

    while ($row = $result->fetch_assoc()) {
    }

Craig



On Wed, 30 Dec 2020 at 18:33, Kamil Tekiela <tekiela246@gmail.com> wrote:

> Hi Internals,
>
> I would like to start a discussion about possible improvements to the
> mysqli API. I have written an RFC which explains all my ideas.
>
> https://wiki.php.net/rfc/improve_mysqli
>
> As the RFC is nothing more than a concept at the moment I am looking
> for some feedback. I attempted to implement some of the changes myself
> but due to my limited experience with C and PHP internals I didn't get
> far. I would appreciate if some volunteer would like to help me to
> implement the changes once they are ironed out.
>
> I understand that the RFC will need to be split up before voting.
>
> Kind regards,
> Kamil Tekiela
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>
>

--00000000000075807c05b7c0ecbf--