Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129684
Content-Type: text/plain;
	charset=us-ascii
Precedence: list
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.200.81.1.6\))
Subject: Re: [PHP-DEV] [RFC] New function mysqli_quote_string
In-Reply-To: <ff18b588-3874-4229-8a4a-58d25dce19e6@beccati.com>
Date: Wed, 24 Dec 2025 03:26:28 +0000
Cc: PHP internals <internals@lists.php.net>,
 Kamil Tekiela <tekiela246@gmail.com>
Content-Transfer-Encoding: quoted-printable
Message-ID: <BBFCB11A-0B83-49CA-978D-F384864FF70F@craigfrancis.co.uk>
References: <CAGBsUrcKTcCzf5k_tGbk=cr02NrsEKPE=Y+CeSOqMrrdjKFftg@mail.gmail.com>
 <23051439-6f0d-4175-b632-3b943582bfe0@beccati.com>
 <CAGBsUrfwRdKj=i3xQeMx+kJ-_=g1Db0D-mBpxhTeRC56kVZPxw@mail.gmail.com>
 <ff18b588-3874-4229-8a4a-58d25dce19e6@beccati.com>
To: Matteo Beccati <php@beccati.com>
From: craig@craigfrancis.co.uk (Craig Francis)

On 20 Dec 2025, at 07:49, Matteo Beccati <php@beccati.com> wrote:
> [...] Saying that we need to do that in core to avoid users =
"accidentally forgetting the quotation marks" seems a bit of an =
overstatement. If they had forgotten the quotes, most of the times the =
query would error out rather than silently working and allowing =
SQL-injection.



I wish most of the time it would error... exhibit A, found a couple of =
weeks ago.


$db->query('SELECT name FROM user WHERE id =3D ' . =
$db->real_escape_string($_GET['id']));


Just as an aside, Kamil, I like your proposal; while I hope that one day =
parameterised queries are used by everyone, we still live in a world =
where developers escape values themselves, and your proposal would =
reduce the chance of them making mistakes.

Craig