Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115451
MIME-Version: 1.0
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CAFv4g+ErRYaGJKJRJm9qYvCMQzUgbJE_hYfhTn6CtSeZ9SKxNw@mail.gmail.com>
 <CAFv4g+FH2ntZz_fSKhoFDMmjaDVhs56oR7x4tE3F250CAZsNtg@mail.gmail.com>
 <CAJmy8YFT9UA8fGmfAh9vcKQA=uM8nuSnEeu4U2sdD1oxQq1YjQ@mail.gmail.com>
 <CAFv4g+Hzgsjr6W=HWaWi2C1Joxz8Jg3PGwQCL7beVZc2YpLuHA@mail.gmail.com> <CAJmy8YG5ttP_dDKu8zaN39S0cUM8AZGswvVedsGPcgK_CMvbCA@mail.gmail.com>
In-Reply-To: <CAJmy8YG5ttP_dDKu8zaN39S0cUM8AZGswvVedsGPcgK_CMvbCA@mail.gmail.com>
Date: Sat, 17 Jul 2021 10:59:07 +0100
Message-ID: <CAFv4g+GnDswDDw+_PKs1wz41EoNxnrQJdmieKTQXychbx_Mymw@mail.gmail.com>
To: Hans Henrik Bergan <divinity76@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000e9ef9405c74ec1e8"
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: craig@craigfrancis.co.uk (Craig Francis)

--000000000000e9ef9405c74ec1e8
Content-Type: text/plain; charset="UTF-8"

On Sat, 17 Jul 2021 at 08:59, Hans Henrik Bergan <divinity76@gmail.com>
wrote:

> i can tell from only that diff that, at least as of 5.5.1,  woocommerce is
> not compatible with @@SQL_MODE=ANSI_QUOTES :p



Yep, and I did that years ago - I preferred to use single quotes for
strings in PHP (so variables stood out), and double quotes for SQL.

Just for fun, `NO_BACKSLASH_ESCAPES` is a good way to mess with people (I
believe the "real" escaping method can catch this, but I wouldn't trust it).

When it comes to escaping in general, my favourite mistake is:

$sql = 'WHERE id = ' . $mysqli->real_escape_string($_GET['id']);

Where the assumed to be number hasn't been quoted at all :-)

PDO::quote() does work a bit better (by adding the quotes itself), but I
still prefer its documentation - noting how the quoted string is only
"theoretically safe", and that "you are strongly recommended to use
PDO::prepare() to prepare SQL statements with bound parameters".

https://www.php.net/manual/en/pdo.quote.php

Craig

--000000000000e9ef9405c74ec1e8--