Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:129745
Precedence: list
MIME-Version: 1.0
Date: Fri, 09 Jan 2026 11:55:45 +0100
To: Kamil Tekiela <tekiela246@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Subject: Re: [PHP-DEV] Re: [RFC] New function mysqli_quote_string
In-Reply-To: <CAGBsUrePjfY6UrkTpV5c1jgZw0jwBmyf+mnFG-AAUJzMmeweAw@mail.gmail.com>
References: <CAGBsUrcKTcCzf5k_tGbk=cr02NrsEKPE=Y+CeSOqMrrdjKFftg@mail.gmail.com>
 <CAGBsUrePjfY6UrkTpV5c1jgZw0jwBmyf+mnFG-AAUJzMmeweAw@mail.gmail.com>
Message-ID: <22fa6377fe0df3afe29fcc332108ba07@bastelstu.be>
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

Am 2026-01-08 21:43, schrieb Kamil Tekiela:
> Despite receiving some criticism, I would like to bring it to a vote 
> still.
> 
> If this method doesn't get added, then it means that this SQL
> injection vulnerability will never be patched. Sure, most users have
> probably switched to prepared statements and we should encourage
> others to do so, but as long as manual escaping exists, it should be
> reliable and not prone to hidden SQL injection.

I'm in favor. It's a localized addition with a clear purpose and 
value-add, a good name and precedent in related extensions. I'm also in 
favor of using deprecations to steer users away from unsafe APIs - even 
when the functionality in question will never be removed. Unfortunately 
getting those voted in is complicated, I've had my fair share of 
experience with that in the past few PHP versions. But I agree that the 
deprecation must not happen in the same version where the replacement is 
added, since this makes incremental roll-outs of the new PHP version 
annoying since there is no version of the code base that is cleanly 
supported by both PHP versions.

With regard to the RFC itself: Please clean up the “Voting Choices” 
section, including properly filling in the vote title. The latter then 
triggers a 14 day cooldown (since changes to the voting widgets are 
Major changes): 
https://github.com/php/policies/blob/main/feature-proposals.rst#types-of-changes

Best regards
Tim Düsterhus