News for hackers. Stuff that matters.

A comment on 80% of the Web Powered by PHP (2017). Parent comment

Re:80% of the Web Powered by PHP (2017) by teh_klev on Friday March 22, 2019 @10:58AM (#19463123)
You missed my point. All developers did was replace their mysql_* calls with mysqli_* calls but skipped out on the parameterising step. Sure they're using a parameterised capable API, but they're not actually parameterising their queries.

In the real world dropping the mysql_* API achieved next to bugger all, we still ended up with a bunch sites with exactly the same SQL injection vulns.

[ Parent | on HN ]
Re:80% of the Web Powered by PHP (2017) by nkozyra on Friday March 22, 2019 @11:09AM (#19463261)
> All developers did was replace their mysql_*

They did? All of them? Nobody moved to paramaterized queries?

[ Parent | on HN ]
Re:80% of the Web Powered by PHP (2017) by teh_klev on Friday March 22, 2019 @11:15AM (#19463329)
When you work for a mass market shared hoster you get to see all sorts of ugliness, dirty hacks, incompetence and just plain lazyness.
[ Parent | on HN ]
Re:80% of the Web Powered by PHP (2017) by ars on Friday March 22, 2019 @01:52PM (#19465008)
New code sure? But existing code? Especially large projects? No.
[ Parent | on HN ]
Re:80% of the Web Powered by PHP (2017) by nkozyra on Friday March 22, 2019 @04:52PM (#19466818)
I am 100% a LOT of projects fall under this umbrella, but:

1) this is not an argument for leaving an inferior library in the language

2) plenty of people do update their software, for old code and large projects. Why not push people toward the better library?

[ Parent | on HN ]