Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115027
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.100.0.2.22\))
In-Reply-To: <F861461F-D070-4808-8B2E-A9BBF753CE6C@newclarity.net>
Date: Tue, 22 Jun 2021 21:35:03 +0700
Cc: Kamil Tekiela <tekiela246@gmail.com>,
 PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <83D62559-0B87-4723-93B8-801905508E1F@koalephant.com>
References: <4FFA0160-1A05-4DA0-9C9A-79F778443A35@newclarity.net>
 <CAGBsUre=Asp+arHBWK0VdT-YdM=_3rR+WOhQQeghFVwsR+nGUg@mail.gmail.com>
 <F861461F-D070-4808-8B2E-A9BBF753CE6C@newclarity.net>
To: Mike Schinkel <mike@newclarity.net>
Subject: Re: [PHP-DEV] Sql Object Model Parser & Sanitizer (was [RFC]
 is_literal)
From: php-lists@koalephant.com (Stephen Reay)



> On 22 Jun 2021, at 20:39, Mike Schinkel <mike@newclarity.net> wrote:
>=20
>> On Jun 22, 2021, at 9:00 AM, Kamil Tekiela <tekiela246@gmail.com> =
wrote:
>>=20
>> Hi Mike,
>>=20
>> Please don't do this. We already have PDO with prepared statements. =
The data must be bound. This is the secure way of writing SQL queries.=20=

>=20
> The problem is that over 40% of the web currently runs on PHP code =
that using mysqli.  That CMS does not support PDO nor prepared =
statements, and is unlikely to switch to it anytime some in the =
foreseeable future. =20
>=20
> A SQL object model parser and sanitizer could more easily be used =
incrementally by that CMS since PDO does not share connections with =
mysqli (AFAIK, anyway.)
>=20

(Resending from on-list address)

Apparently you didn't know mysqli supports parameterised queries?
Wordpress could have adopted parameterised queries when they grudgingly =
switched to mysqli, years after both it and PDO were introduced.
There=E2=80=99s zero reason to believe they would adopt this unless =
forced to.