Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117593
Message-ID: <1804F385-5BB5-4614-8EB3-01042DCF0DD3@craigfrancis.co.uk>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_FE7E6E4D-FBD1-4B24-A54E-A4E559CEE4BB"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.80.82.1.1\))
Date: Mon, 25 Apr 2022 12:05:26 +0100
In-Reply-To: <CAC5V6gh1g5mV9OL405u3oLu3N3qTyD5w4e-dUxx4Rdo=cTTVCw@mail.gmail.com>
Cc: PHP internals <internals@lists.php.net>
To: Guilliam Xavier <guilliam.xavier@gmail.com>
References: <CAFv4g+HVtZPhaq+=28ViN8rJKCHCtNJuEWYpWvdSi54_3aNTmg@mail.gmail.com>
 <CAFv4g+FFTzDqw2cyMj1=xuqHF9idV7fyE_W4f8iuxqe2zsE4uw@mail.gmail.com>
 <CAC5V6gh1g5mV9OL405u3oLu3N3qTyD5w4e-dUxx4Rdo=cTTVCw@mail.gmail.com>
Subject: Re: [PHP-DEV] MySQLi Execute Query RFC
From: craig@craigfrancis.co.uk (Craig Francis)

--Apple-Mail=_FE7E6E4D-FBD1-4B24-A54E-A4E559CEE4BB
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On 22 Apr 2022, at 13:09, Guilliam Xavier <guilliam.xavier@gmail.com> =
wrote:
> > https://wiki.php.net/rfc/mysqli_execute_query =
<https://wiki.php.net/rfc/mysqli_execute_query>
>=20
> Thanks. Maybe add (or even start with) an example of mysqli_query(), =
to show how "migrating to safer" would become easier? retro-fitting your =
example of parameterised query:



Thanks Guilliam, that's a good idea.

To keep it short, I've gone with a more traditional use of =
`$db->real_escape_string()` with string concatenation, including a =
classic mistake with missing quotes around integer values :-)

I do like your example with `vsprintf()`, but I needed to replace the =
"?" with "%s" as well, with made it look more complicated than pre-8.1 =
prepared statements, I hope that's ok.

Craig


--Apple-Mail=_FE7E6E4D-FBD1-4B24-A54E-A4E559CEE4BB--