Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on PHP 7 deployment at Dailymotion. Parent comment
People do still write PHP like this, because they aren't even aware that SQL injection is a thing. I've seen it in code written relatively recently.
>Are you expecting it to be an integer? Easy >if(!ctype_digit($_POST['ID'])) { // throw exception here }
You forgot to check that the index "ID" exists first, that will throw a warning if it doesn't.
>Contrary to the hive mind you don't need some special encapsulation class to pull your post and get variables.
You don't need it,but encapsulation is still useful. You may want to use some source other than the superglobals, maybe for testing.
>What's with people expecting frameworks to do everything for them these days?
Frameworks are supposed to come with proper data validation out of the box - if they don't, they're bad frameworks.
There are no comments on this comment yet.
People do still write PHP like this, because they aren't even aware that SQL injection is a thing. I've seen it in code written relatively recently.
>Are you expecting it to be an integer? Easy >if(!ctype_digit($_POST['ID'])) { // throw exception here }
You forgot to check that the index "ID" exists first, that will throw a warning if it doesn't.
>Contrary to the hive mind you don't need some special encapsulation class to pull your post and get variables.
You don't need it,but encapsulation is still useful. You may want to use some source other than the superglobals, maybe for testing.
>What's with people expecting frameworks to do everything for them these days?
Frameworks are supposed to come with proper data validation out of the box - if they don't, they're bad frameworks.