Re:Ask HN: Why no love for PHP?
by EliAndrewC on Wednesday May 06, 2009 @01:40PM
(#596274)
I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html
It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.
I regard string concatenation as very annoying in Java.
Actually, just about anything is annoying in Java. I guess I have been spoiled by more modern languages like... Smalltalk/80 or Lisp'56.
I wouldn't be so hard on php for the mysql_* functions; they're wrappers around the C functions of the same names:
http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.h...
I wouldn't use C for web applications, either.
Re:Ask HN: Why no love for PHP?
by abyssknight on Thursday May 07, 2009 @10:26AM
(#597959)
They do exist, but I would never use any of them. I'd use a prepared statement. PHP has come a long way since stripslashes. It just isn't flavor of the month.
----------
mysql_escape_string() - Escapes a string for use in a mysql_query
mysql_real_escape_string() - Escapes special characters in a string for use in a SQL statement
mysqli_real_escape_string() - Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection
addslashes() - Quote string with slashes
stripslashes() - Un-quotes a quoted string
The magic_quotes_gpc directive
The magic_quotes_runtime directive
stripcslashes() - Un-quote string quoted with addcslashes
stripslashes() - Un-quotes a quoted string
addcslashes() - Quote string with slashes in a C style
htmlspecialchars() - Convert special characters to HTML entities
quotemeta() - Quote meta characters
get_magic_quotes_gpc() - Gets the current configuration setting of magic quotes gpc
----------------
I especially love the contrast between "mysql_escape_string" and "mysql_real_escape_string," since the first one is fake in a magical, side-effect-laden way.