Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129659
Precedence: list
MIME-Version: 1.0
References: <CAGBsUrcKTcCzf5k_tGbk=cr02NrsEKPE=Y+CeSOqMrrdjKFftg@mail.gmail.com>
 <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com> <CAGBsUrfwRdKj=i3xQeMx+kJ-_=g1Db0D-mBpxhTeRC56kVZPxw@mail.gmail.com>
In-Reply-To: <CAGBsUrfwRdKj=i3xQeMx+kJ-_=g1Db0D-mBpxhTeRC56kVZPxw@mail.gmail.com>
Date: Fri, 19 Dec 2025 16:09:32 +0100
Message-ID: <CAJmy8YEZmC0yEA_QyJnj4TGS1quXqV2MfaUsVQSeXSzkNXsBuA@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] New function mysqli_quote_string
To: Kamil Tekiela <tekiela246@gmail.com>
Cc: Matteo Beccati <php@beccati.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000001ac58e06464f7a5f"
From: divinity76@gmail.com (Hans Henrik Bergan)

--0000000000001ac58e06464f7a5f
Content-Type: text/plain; charset="UTF-8"

On Fri, 19 Dec 2025 at 15:26, Kamil Tekiela <tekiela246@gmail.com> wrote:

> On Fri, 19 Dec 2025 at 13:52, Matteo Beccati <php@beccati.com> wrote:
> >
> > Hi Kamil,
> >
> >
> > Il 18/12/2025 22:03, Kamil Tekiela ha scritto:
> > > Hello,
> > >
> > > I would like to open a discussion about adding a new function to PHP
> > >
> > > https://wiki.php.net/rfc/mysqli_quote_string
> > >
> > > Would you support such an addition?
> >
> > I agree with you and I prefer PDO::quote()'s behaviour over the "old"
> > non-pdo quote functions.
> >
> > However, I also think that manually interpolating parameters is not a
> > best practice that we should encourage: query parameters are the a much
> > better defence against SQL injections.
> >
> > Also I'm afraid that offering two alternatives would increase the
> > confusion, especially if this new function is added only to mysqli and
> > not other prominent database extensions.
> >
> >
> > Cheers
> > --
> > Matteo
>
> Hi Mateo,
>
> The new function isn't meant to encourage this practice. My RFC
> acknowledges that query parameters are the best, but unfortunately,
> manual escaping is a must for certain applications.
>
> What other extensions do you have in mind? PDO already has it, so does
> PostgreSQL with pg_escape_literal(). Every extension is different and
> they never have the exact same functions. In fact, what I am proposing
> is to bring mysqli in line with other extensions which already have
> it.
>
> The confusion it's going to cause is minimal. The behaviour is exactly
> the same as the old function, just that the quotation marks are added
> automatically. It's not rocket science.
>
> Regards,
> Kamil
>

btw pg_escape_literal is mis-named. it does not escape - it quotes.
And there is an important difference between escaping and quoting,
at least for SQLite, it is impossible to make a binary-safe escape()
function,
but it's fully possible to make a binary-safe quote() function
(see https://github.com/php/php-src/pull/13972 )

IMO  pg_escape_literal should be renamed pg_quote_literal.

--0000000000001ac58e06464f7a5f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, 19 Dec =
2025 at 15:26, Kamil Tekiela &lt;<a href=3D"mailto:tekiela246@gmail.com">te=
kiela246@gmail.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote=
" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);=
padding-left:1ex">On Fri, 19 Dec 2025 at 13:52, Matteo Beccati &lt;<a href=
=3D"mailto:php@beccati.com" target=3D"_blank">php@beccati.com</a>&gt; wrote=
:<br>
&gt;<br>
&gt; Hi Kamil,<br>
&gt;<br>
&gt;<br>
&gt; Il 18/12/2025 22:03, Kamil Tekiela ha scritto:<br>
&gt; &gt; Hello,<br>
&gt; &gt;<br>
&gt; &gt; I would like to open a discussion about adding a new function to =
PHP<br>
&gt; &gt;<br>
&gt; &gt; <a href=3D"https://wiki.php.net/rfc/mysqli_quote_string" rel=3D"n=
oreferrer" target=3D"_blank">https://wiki.php.net/rfc/mysqli_quote_string</=
a><br>
&gt; &gt;<br>
&gt; &gt; Would you support such an addition?<br>
&gt;<br>
&gt; I agree with you and I prefer PDO::quote()&#39;s behaviour over the &q=
uot;old&quot;<br>
&gt; non-pdo quote functions.<br>
&gt;<br>
&gt; However, I also think that manually interpolating parameters is not a<=
br>
&gt; best practice that we should encourage: query parameters are the a muc=
h<br>
&gt; better defence against SQL injections.<br>
&gt;<br>
&gt; Also I&#39;m afraid that offering two alternatives would increase the<=
br>
&gt; confusion, especially if this new function is added only to mysqli and=
<br>
&gt; not other prominent database extensions.<br>
&gt;<br>
&gt;<br>
&gt; Cheers<br>
&gt; --<br>
&gt; Matteo<br>
<br>
Hi Mateo,<br>
<br>
The new function isn&#39;t meant to encourage this practice. My RFC<br>
acknowledges that query parameters are the best, but unfortunately,<br>
manual escaping is a must for certain applications.<br>
<br>
What other extensions do you have in mind? PDO already has it, so does<br>
PostgreSQL with pg_escape_literal(). Every extension is different and<br>
they never have the exact same functions. In fact, what I am proposing<br>
is to bring mysqli in line with other extensions which already have<br>
it.<br>
<br>
The confusion it&#39;s going to cause is minimal. The behaviour is exactly<=
br>
the same as the old function, just that the quotation marks are added<br>
automatically. It&#39;s not rocket science.<br>
<br>
Regards,<br>
Kamil<br></blockquote><div><br></div><div>btw pg_escape_literal is mis-name=
d. it does not escape - it quotes.=C2=A0<br></div><div>And there is an impo=
rtant difference between escaping and quoting,</div><div>at least for SQLit=
e, it is impossible to make a binary-safe escape() function,</div><div>but =
it&#39;s fully=C2=A0possible to make a binary-safe quote() function<br></di=
v><div>(see=C2=A0<a href=3D"https://github.com/php/php-src/pull/13972">http=
s://github.com/php/php-src/pull/13972</a> )</div><div><br></div><div>IMO=C2=
=A0
pg_escape_literal should be renamed pg_quote_literal.</div></div></div>

--0000000000001ac58e06464f7a5f--