PHP to deprecate MySQL extension

Re:PHP to deprecate MySQL extension by jawns on Friday July 15, 2011 @09:19PM (#2769803)

I've experimented with a variation of this.

Something like ...

  foreach($_REQUEST as $k=$v) {
    $REQUEST[$k] = mysql_real_escape_string($v);
  }

  $query = "INSERT INTO table VALUES('$REQUEST[email]', '$REQUEST[name]')";

Problem is, this only works if you don't plan on modifying any of the values before you stick them in the database.

You could also do something like ...

  $query = "INSERT INTO table VALUES('{$e('email')}', '{$e('email')}')";
  $e = 'esc';
  function esc($v) {
    mysql_real_escape_string($v);
  }

But I think that looks pretty ugly.

[ Parent | on HN ]

Re:PHP to deprecate MySQL extension by icode on Sunday July 17, 2011 @05:59AM (#2772989)

Hey, the {$e('$value')} idea is interesting.

old way:

  $sql_email=mysql_real_escape_string($email);
  $sql="UPDATE t WHERE id=123 SET email='$sql_email'";

your idea:

  $sql="UPDATE t WHERE id=123 SET email='{$e($email)}'";

Im not yet sure, which one I like more.

[ Parent | on HN ]