Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129664
Feedback-ID: i6f4c46c2:Fastmail
Message-ID: <ff18b588-3874-4229-8a4a-58d25dce19e6@beccati.com>
Date: Sat, 20 Dec 2025 08:49:04 +0100
Precedence: list
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] New function mysqli_quote_string
To: PHP internals <internals@lists.php.net>
Cc: Kamil Tekiela <tekiela246@gmail.com>
References: <CAGBsUrcKTcCzf5k_tGbk=cr02NrsEKPE=Y+CeSOqMrrdjKFftg@mail.gmail.com>
 <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com>
 <CAGBsUrfwRdKj=i3xQeMx+kJ-_=g1Db0D-mBpxhTeRC56kVZPxw@mail.gmail.com>
Content-Language: it, en-GB
Autocrypt: addr=php@beccati.com; keydata=
 xjMEaPtBFBYJKwYBBAHaRw8BAQdAGO+tvY0cWWnQ/c8pKeza89usSCtuIU/rofMmYKRYhbTN
 IE1hdHRlbyBCZWNjYXRpIDxwaHBAYmVjY2F0aS5jb20+wo8EExYIADcWIQSAAgxDL6AQ85RP
 iXKBm68y9BDZAQUCaPtBFAUJBaOagAIbAwQLCQgHBRUICQoLBRYCAwEAAAoJEIGbrzL0ENkB
 LYIA/3T7lWVp+xMsxGf9o5YpzHAm5+lbwQEAMO/g5nKyk/rKAQCvq3DDNWoXjPam0s+5Pt0z
 zjzYM6qV/tjTzyPUBrHQB844BGj7QRQSCisGAQQBl1UBBQEBB0Ct/I7x5lWDgutczkl00Kg0
 OwotLnLdeOfaU+bDkhGWIQMBCAfCfgQYFggAJhYhBIACDEMvoBDzlE+JcoGbrzL0ENkBBQJo
 +0EUBQkFo5qAAhsMAAoJEIGbrzL0ENkBX+4BAM3Qp4gVnybToqh7tB2HbyOYrExvX4m0p/t8
 IIRF/QCbAQDV84mqLmyLOpigI5IQThXCaaTltA4IeTfVNjnVTv+XDw==
In-Reply-To: <CAGBsUrfwRdKj=i3xQeMx+kJ-_=g1Db0D-mBpxhTeRC56kVZPxw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
From: php@beccati.com (Matteo Beccati)

Hi,

Il 19/12/2025 15:23, Kamil Tekiela ha scritto:
> The new function isn't meant to encourage this practice. My RFC
> acknowledges that query parameters are the best, but unfortunately,
> manual escaping is a must for certain applications.

Such application are certainly capable of adding single quotes? I don't 
think we really need to spoon-feed them with a brand new function after 
25+ years everybody and their dog has been using real_escape_string().

> What other extensions do you have in mind? PDO already has it, so does
> PostgreSQL with pg_escape_literal(). Every extension is different and
> they never have the exact same functions. In fact, what I am proposing
> is to bring mysqli in line with other extensions which already have
> it.

Apologies, I was referring to pg_escape_string(), which I had used back 
in the days. I didn't recall pg_escape_literal + identifier: they have 
been added 14 years ago and they are using the underlying libpq 
PQEscapeLiteral and PQEscapeIdentifier functionality to offer even 
better / safer escaping.

Also ext/sqlite3 offers a non-binary safe escape function without quotes.

> The confusion it's going to cause is minimal. The behaviour is exactly
> the same as the old function, just that the quotation marks are added
> automatically. It's not rocket science.

I agree it's not rocket science to do add **single quotes**. Saying that 
we need to do that in core to avoid users "accidentally forgetting the 
quotation marks" seems a bit of an overstatement. If they had forgotten 
the quotes, most of the times the query would error out rather than 
silently working and allowing SQL-injection.

As for single quotes vs other quote flavours, I reckon it should be 
documentation material, perhaps with a big yellow box like we do for 
charsets.


Cheers
-- 
Matteo