Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121272
MIME-Version: 1.0
References: <CAOfzkkyTkfCKfuLyyGNvrbEORDDxNSetbqtg1WnMO2fzbeyWdw@mail.gmail.com>
In-Reply-To: <CAOfzkkyTkfCKfuLyyGNvrbEORDDxNSetbqtg1WnMO2fzbeyWdw@mail.gmail.com>
Date: Wed, 11 Oct 2023 17:46:56 +0200
Message-ID: <CAGBsUrdaKzG8PYS5ubZTP9Mq0xSO84wSwi=mm2ChcTYWpgNUGA@mail.gmail.com>
To: Karoly Negyesi <karoly@negyesi.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000004ccc9f060772bcc8"
Subject: Re: [PHP-DEV] Expose pdo_parse_params to userspace
From: tekiela246@gmail.com (Kamil Tekiela)

--0000000000004ccc9f060772bcc8
Content-Type: text/plain; charset="UTF-8"

Hi,

I have to say I am not a fan of this proposal. While definitely a super
nice feature in PDO, it's more of a hack rather than proper feature.
Certain RDBMSs support named parameters in prepared statements, but MySQL
doesn't. Therefore, the solution implemented in PDO is a hack. It's very
flawed and the current implementation has multiple bugs and shortcomings.
One could say that some bugs are security issues.

For the above reason, I don't think we should support this in mysqli. We
cannot reliably implement such feature. We could make a copy of
pdo_parse_params and fix as many MySQL issues as possible, but we would
never be able to fix it fully due to the nature of MySQL API.

If someone wants to implement this in userland, then be my guest. As long
as you are aware of the shortcomings and you know how to use it safely then
it's fine.

Unrelated, but I would not consider the async feature of mysqli useful or
even a good reason to abandon PDO. IMHO the async feature is a failed
experiment with limited applicability.

Regards,
Kamil Tekiela

--0000000000004ccc9f060772bcc8--