Ask YC: Those using PHP, what do you use for talking to your database (MySQL)?

Re:Ask YC: Those using PHP, what do you use for talking to y... by ars on Monday August 11, 2008 @12:38PM (#273088)

The regular mysql functions, except I made a wrapper for mysql_query to abort on an error, so I don't have to type that every time. But my wrapper explicitly allows you to use the regular mysql_query function if you want. I hate wrappers that hide the underlying system.

I don't wrap the mysql_fetch* functions because that slows them down (lots of string copying). Plus, they don't need it.

I also like:

  function ms($string) {
    return "'" . mysql_real_escape_string($string) . "'";
  }

Very helpful for preventing sql injections, it's so short to type that I always remember to use it. And by including the quote marks right in it I don't have to go nuts escaping the quotes in the outer query.

If you use mysqli you don't need this - use bind variables instead.

[ Parent | on HN ]

Re:Ask YC: Those using PHP, what do you use for talking to y... by agotterer on Monday August 11, 2008 @02:16PM (#273183)

I use this to clean all my strings:

private function clean_string($string, $strip_tags = true) {

     if (!strlen($string)) return NULL;

     if (get_magic_quotes_gpc()) $string = stripslashes($string);
		
     if($strip_tags)
	$string = strip_tags($string);
		
     if (!is_numeric($string)) {
         $string = mysql_escape_string($string);
     }
		
     return $string;

}

Edit: You only need to use mysql_real_escape_string if you are inserting binary data or need to use database character sets. mysql_real_escape_string also requires a mysql connection and link identifier.

[ Parent | on HN ]

Re:Ask YC: Those using PHP, what do you use for talking to y... by invisible on Monday August 11, 2008 @03:37PM (#273256)

  private function clean_string($string, $strip_tags = true,$empty_null = true) {
    if (!strlen($string) and $empty_null) return NULL;
    if($strip_tags)
      $string = strip_tags($string);
  
    return get_magic_quotes_gpc() ? mysql_escape_string(stripslashes($string)) : mysql_escape_string($string);
  }

This is most likely faster because you're not changing the memory so frequently. In this is_numeric isn't needed because it'd just slow things down. It's really good practice to use mysql_real_escape_string, but I respect this way for simplicity's sake.

[ Parent | on HN ]