Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129658
Precedence: list
MIME-Version: 1.0
References: <CAGBsUrcKTcCzf5k_tGbk=cr02NrsEKPE=Y+CeSOqMrrdjKFftg@mail.gmail.com>
 <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com>
In-Reply-To: <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com>
Date: Fri, 19 Dec 2025 14:23:34 +0000
Message-ID: <CAGBsUrfwRdKj=i3xQeMx+kJ-_=g1Db0D-mBpxhTeRC56kVZPxw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] New function mysqli_quote_string
To: Matteo Beccati <php@beccati.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
From: tekiela246@gmail.com (Kamil Tekiela)

On Fri, 19 Dec 2025 at 13:52, Matteo Beccati <php@beccati.com> wrote:
>
> Hi Kamil,
>
>
> Il 18/12/2025 22:03, Kamil Tekiela ha scritto:
> > Hello,
> >
> > I would like to open a discussion about adding a new function to PHP
> >
> > https://wiki.php.net/rfc/mysqli_quote_string
> >
> > Would you support such an addition?
>
> I agree with you and I prefer PDO::quote()'s behaviour over the "old"
> non-pdo quote functions.
>
> However, I also think that manually interpolating parameters is not a
> best practice that we should encourage: query parameters are the a much
> better defence against SQL injections.
>
> Also I'm afraid that offering two alternatives would increase the
> confusion, especially if this new function is added only to mysqli and
> not other prominent database extensions.
>
>
> Cheers
> --
> Matteo

Hi Mateo,

The new function isn't meant to encourage this practice. My RFC
acknowledges that query parameters are the best, but unfortunately,
manual escaping is a must for certain applications.

What other extensions do you have in mind? PDO already has it, so does
PostgreSQL with pg_escape_literal(). Every extension is different and
they never have the exact same functions. In fact, what I am proposing
is to bring mysqli in line with other extensions which already have
it.

The confusion it's going to cause is minimal. The behaviour is exactly
the same as the old function, just that the quotation marks are added
automatically. It's not rocket science.

Regards,
Kamil