On Sat, 28 Nov 2020 at 16:26, Kamil Tekiela <tekiela246@gmail.com> wrote:
> I would like to hear your opinions about the following page in the PHP
> manual:
> https://www.php.net/manual/en/mysqli.examples-basic.php
Oh, wow, I didn't expect to find this on the PHP website:
$aid = (int) $_GET['aid'];
> ...
> $sql = "SELECT actor_id, first_name, last_name FROM actor WHERE actor_id =
> $aid";
> if (!$result = $mysqli->query($sql)) {
> ...
Please remove this as soon as possible.
Maybe just replace it with a link to this page:
https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php
While I'm not a fan of mysqli bind_param (far too complicated for new
developers), it's needed to use mysqli safely (allows the SQL string to be
made entirely of programmer defined, safe literals, not tainted by external
sources).
e.g. this common mistake, which doesn't quote the escaped value, does not
consider NO_BACKSLASH_ESCAPES, and can still have encoding issues:
$sql = "SELECT actor_id, first_name, last_name FROM actor WHERE actor_id =
> " . mysqli_real_escape_string($mysqli, $aid);
Craig
On Sat, 28 Nov 2020 at 16:26, Kamil Tekiela <tekiela246@gmail.com> wrote: