Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113310
To: PHP internals <internals@lists.php.net>
References: <CAGBsUrddzJQu3JtqCdLjyHOBf71gj5LpNKuV=OmYGm0Vd3n9Yw@mail.gmail.com>
 <CAF+90c8GDMs5f0i27n8gGNx_TvwqKH9CqsW8eSgEf+8mGrdyZA@mail.gmail.com>
 <84a86f15-313e-1fb3-eb09-7fd6bbdeb5ce@php.net>
 <821813eb972cd5dad30a0e10385a115a9a8908a2.camel@schlueters.de>
 <CAGBsUrfF5Xk+ne6fo46EivKN82OQeM=0yAcPe5r2y9-ZgPEYrw@mail.gmail.com>
 <2d9e003c-2a05-9cfa-8625-5aedf5b069f6@gmail.com>
 <CAGBsUrf2CNq33sQ1HLCAkzT+P1BaykYPfmf4Wsx0MZNtZUz+MQ@mail.gmail.com>
Message-ID: <445707c1-2b67-1f46-8d93-d9e0ca420b87@gmail.com>
Date: Sat, 27 Feb 2021 17:52:29 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.0
MIME-Version: 1.0
In-Reply-To: <CAGBsUrf2CNq33sQ1HLCAkzT+P1BaykYPfmf4Wsx0MZNtZUz+MQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] [RFC]: Change Default mysqli Error Mode
From: rowan.collins@gmail.com (Rowan Tommins)

On 27/02/2021 16:57, Kamil Tekiela wrote:
>
>     If product_id is actually an integer column, this function is
>     technically broken: given a non-integer input, it will produce an
>     error
>     in the database.
>
>
> I'm sorry, but I do not understand why would that code produce an 
> error. The value is properly escaped and formatted so there should be 
> no error at all. Is this based on some SQL setting? That SQL looks 
> correct to me and I do not see any syntax errors.


That's precisely why it's the kind of code that goes unfixed for years, 
but it is broken: if $product_id is the string 'hello world', then this 
line...

$sql = "Select * From products Where product_id = '" . 
$dbWrapper->escape($product_id) . "'";

...produces this SQL:

Select * From products Where product_id = 'hello world'

If product_id is a column of type int, then the database will raise an 
error about incompatible types.


If the PHP database wrapper just swallows this error and returns false, 
then somewhere else in the code, you can write this:

$product = get_product($_GET['product_id']);
if ( ! $product ) {
    display_error_message('Sorry, we could not find that product.');
}

So although the code is wrong, the user always gets a reasonable error 
message. Now replace the database implementation with one that throws 
exceptions, and that message will never display; if you're lucky, 
there's a default exception handler set; if not, the user will get a 
blank white page.


Regards,

-- 
Rowan Tommins
[IMSoP]