Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:64030
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAKOpQSwkiRhPn5=UJ+NC_beyyEA4Q5aQEx3yQWMqPB+2adGgag@mail.gmail.com>
References: <CADajX4CYZdNpgQv46m_6J7tQLBc=h6HxCn-bGpxr3Ou2VaqgBg@mail.gmail.com>
	<alpine.DEB.2.02.1211121620380.23571@whisky.home.derickrethans.nl>
	<50ACF6BF.4060502@cubiclesoft.com>
	<CAKOpQSwkiRhPn5=UJ+NC_beyyEA4Q5aQEx3yQWMqPB+2adGgag@mail.gmail.com>
Date: Wed, 21 Nov 2012 11:42:21 -0800
Message-ID: <CAFWS2+ELpS=oyn0WSsghL5p+=ee4PDm=c2DQJPx77hCozYiLaQ@mail.gmail.com>
To: Kris Craig <kris.craig@gmail.com>
Cc: Thomas Hruska <thruska@cubiclesoft.com>, PHP Development <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] RFC: ext/mysql deprecation
From: ronabop@gmail.com (Ronald Chmara)

On Wed, Nov 21, 2012 at 10:56 AM, Kris Craig <kris.craig@gmail.com> wrote:
> On Wed, Nov 21, 2012 at 7:43 AM, Thomas Hruska <thruska@cubiclesoft.com>wrote:
>> On 11/12/2012 9:22 AM, Derick Rethans wrote:
>> Why deprecate?  Just because you like PDO doesn't mean everyone else will
>> like it.  Just because mysql_query() tends to create security
>> vulnerabilities in the hands of the uneducated who have the tendency to
>> string concatenate SQL queries together in an unsafe fashion, doesn't mean
>> users won't write insecure code with PDO.  Users are lazy - binding each
>> field separately is going to drive some to resort to string concatenation,
>> which will result in a situation nearly identical to what you have already.
>>  In the hands of someone who knows what they are doing, ext/mysql is the
>> same as, if not better than, mysqli and PDO.
> PHP is not etched in stone.  It is an ever-evolving, ever-improving
> language.  I'm not sure I understand the reasoning behind your "ext/mysql
> is the same as, if not better than, mysqli and PDO" remark.

"In the hands of someone who knows what they are doing, ext/mysql is
the same as, if not better than, mysqli and PDO."
...is the sentence in question. Note the qualifier.

> The ext/mysql
> extension does not support prepared statements; mysqli and PDO do

If you know what your're doing, prepared statement workflows are just
wasteful code bloat with absolutely no  tangible benefits.
Again, note the qualifier.

> There is simply no rational reason for continuing to use ext/mysql over
> mysqli and PDO.

Not editing millions of lines of stable, and secure, code is a rational reason.

>  It does present significant security vulnerabilities.

<sarcasm>
Well, C has had tons of insecurities over the years, maybe we should
migrate PHP to be written in, oh, Ruby or something new and shiny like
that, because newer languages make shooting yourself in the foot
harder, and "new" somehow means "secure".
</sarcasm>

If there are actual security vulnerabilities in ext/mysql, by all
means, that's a good reason for rapid deprecation, but if there are
security vulnerabilities because people who *didn't know what they
were doing*.created them, that's a battle that cannot be won.

-Ronabop