Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129662
Precedence: list
MIME-Version: 1.0
References: <CAGBsUrcKTcCzf5k_tGbk=cr02NrsEKPE=Y+CeSOqMrrdjKFftg@mail.gmail.com>
 <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com>
In-Reply-To: <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com>
Date: Fri, 19 Dec 2025 23:45:32 +0100
Message-ID: <CADyq6sJtmcGmog1B4M9LR9CjWCj_2cCZJ=Stz0WhexwhSh78Ug@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] New function mysqli_quote_string
To: Matteo Beccati <php@beccati.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000812e4f064655d67a"
From: ocramius@gmail.com (Marco Pivetta)

--000000000000812e4f064655d67a
Content-Type: text/plain; charset="UTF-8"

Hey Kamil, Matteo,

I initially looked at the mail by Kamil, and thought this was about
quoting, to which I told myself "fine, that's useful".

After reviewing the contents, plus Matteo's response, it is clear to me
that this is another attempt at escaping aimed at string interpolation.

I'd be opposed to that, even just for the fact that we're adding more tools
to a toolbox that should instead point at prepared statements.
Projects like PHPMyAdmin have vast experience in handling this sort of API,
and they should just do it themselves. BTW, it would be interesting to show
exactly (in the RFC text) why/where these projects can't use prepared
statements.

If you were to propose something about quoting (with the correct backtick
syntax, perhaps even based on the current set SQL compatibility mode), then
that could be marginally interesting.

Greets,

Marco Pivetta

https://mastodon.social/@ocramius

https://ocramius.github.io/


On Fri, 19 Dec 2025 at 14:52, Matteo Beccati <php@beccati.com> wrote:

> Hi Kamil,
>
>
> Il 18/12/2025 22:03, Kamil Tekiela ha scritto:
> > Hello,
> >
> > I would like to open a discussion about adding a new function to PHP
> >
> > https://wiki.php.net/rfc/mysqli_quote_string
> >
> > Would you support such an addition?
>
> I agree with you and I prefer PDO::quote()'s behaviour over the "old"
> non-pdo quote functions.
>
> However, I also think that manually interpolating parameters is not a
> best practice that we should encourage: query parameters are the a much
> better defence against SQL injections.
>
> Also I'm afraid that offering two alternatives would increase the
> confusion, especially if this new function is added only to mysqli and
> not other prominent database extensions.
>
>
> Cheers
> --
> Matteo
>

--000000000000812e4f064655d67a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hey Kamil, Matteo,</div><div><br></div><div>I initial=
ly looked at the mail by Kamil, and thought this was about quoting, to whic=
h I told myself &quot;fine, that&#39;s useful&quot;.=C2=A0</div><div><br></=
div><div>After reviewing the contents, plus Matteo&#39;s response, it is cl=
ear to me that this is another attempt at escaping aimed at string interpol=
ation.</div><div><br></div><div>I&#39;d be opposed to that, even just for t=
he fact that we&#39;re adding more tools to a toolbox that should instead p=
oint at prepared statements.</div><div>Projects like PHPMyAdmin have vast e=
xperience in handling this sort of API, and they should just do it themselv=
es. BTW, it would be interesting to show exactly (in the RFC text) why/wher=
e these projects can&#39;t use prepared statements.</div><div><br></div><di=
v>If you were to propose something about quoting (with the correct backtick=
 syntax, perhaps even based on the current set SQL compatibility mode), the=
n that could be marginally interesting.</div><div><br></div><div>Greets,</d=
iv><div><br></div><div><div dir=3D"ltr" class=3D"gmail_signature" data-smar=
tmail=3D"gmail_signature"><div dir=3D"ltr">Marco Pivetta <br><br><a href=3D=
"https://mastodon.social/@ocramius" target=3D"_blank">https://mastodon.soci=
al/@ocramius</a><br><br><a href=3D"https://ocramius.github.io/" target=3D"_=
blank">https://ocramius.github.io/</a><br></div></div></div><br></div><br><=
div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"g=
mail_attr">On Fri, 19 Dec 2025 at 14:52, Matteo Beccati &lt;<a href=3D"mail=
to:php@beccati.com">php@beccati.com</a>&gt; wrote:<br></div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">Hi Kamil,<br>
<br>
<br>
Il 18/12/2025 22:03, Kamil Tekiela ha scritto:<br>
&gt; Hello,<br>
&gt; <br>
&gt; I would like to open a discussion about adding a new function to PHP<b=
r>
&gt; <br>
&gt; <a href=3D"https://wiki.php.net/rfc/mysqli_quote_string" rel=3D"norefe=
rrer" target=3D"_blank">https://wiki.php.net/rfc/mysqli_quote_string</a><br=
>
&gt; <br>
&gt; Would you support such an addition?<br>
<br>
I agree with you and I prefer PDO::quote()&#39;s behaviour over the &quot;o=
ld&quot; <br>
non-pdo quote functions.<br>
<br>
However, I also think that manually interpolating parameters is not a <br>
best practice that we should encourage: query parameters are the a much <br=
>
better defence against SQL injections.<br>
<br>
Also I&#39;m afraid that offering two alternatives would increase the <br>
confusion, especially if this new function is added only to mysqli and <br>
not other prominent database extensions.<br>
<br>
<br>
Cheers<br>
-- <br>
Matteo<br>
</blockquote></div>

--000000000000812e4f064655d67a--