Re:80% of the Web Powered by PHP (2017)
by Izkata on Friday March 22, 2019 @04:47PM
(#19466773)
You seem to have totally missed the point: mysql_* were removed in order to prevent string-concat SQL from being used, but people just end up doing the same thing with the new methods, so there was no benefit to removing them.
[ Parent
| on HN ]
ext/mysql was not removed "to prevent string-concat SQL from being used." ext/mysqli and PDO allow raw SQL to be executed as well. It's just a necessary feature in some cases, but it should be reserved for static SQL.
Forming SQL by concatenating strings and variables is just bad practice and hopefully we can agree on that. ext/mysql provided no other option and this was just one of many issues with the extension.
Using ext/mysqli and PDO in a such a way (and I don't care if you're talking about retrofitting old code) is not even bad practice, it's just improper usage of the API when prepared statements should be used instead.
EDIT: Individually `print` `echo` `shell_exec` may be just as dangerous... It's up to the developer if they want to use them correctly.
> Individually `print` `echo` `shell_exec` may be just as dangerous... It's up to the developer if they want to use them correctly.
and you don't have to install ext/mysql, they could just remove it from default configuration