News for hackers. Stuff that matters.

A comment on Don’t try to sanitize input – escape output. Parent comment

Re:Don’t try to sanitize input – escape output by teh_klev on Thursday February 27, 2020 @01:11PM (#22435938)
> But that's not a thing for 15 years or more? PDO was added around 2005

Ex-shared hosting bod here, who had the joy of managing our PHP environments :(

Sadly in the real world, even after the great big (and pointless) act of deprecating and removing the mysql_* library, naive developers (and experienced ones that should've know better) just moved onto mysqli_* or PDO and still used string concatenation with raw inputs, instead of learning how to parameterise their queries.

Used to drive me flippin' nuts.

[ Parent | on HN ]
Re:Don’t try to sanitize input – escape output by ivanhoe on Friday February 28, 2020 @07:55AM (#22442427)
> naive developers (and experienced ones that should've know better) just moved onto mysqli_* or PDO and still used string concatenation with raw inputs, instead of learning how to parameterise their queries.

True, I stand corrected, I've just checked and Wordpress still does it just like that: https://github.com/WordPress/WordPress/blob/master/wp-includ...

[ Parent | on HN ]