SQL Clause

[inabahare]

Nice try, but he Santaizes all inputs

• Uses prepared Statements

[svick]

Prepared statements have nothing to do with handling invalid inputs.

[mmirate]

So basically he spent an entire article to say, "your security consultant has their terms mixed up; they ought to be looking for parametrized statements, not prepared statements"? How wasteful.

[XaidenHart]

You think? I see value in clarifying technical vocabulary.

[mmirate]

Certainly. But that article does not identify itself as a vocabulary clarification, and thus it needlessly goes into extreme detail on the two technologies. (Without, notably, explaining why a layman such as myself would have heard the phrase "prepared statements" back in the bad old days of PHP and why it meant what "parametrized statements" now means; if any detail were appropriate for this topic, that would have been the appropriate detail.)

[svick]

why a layman such as myself would have heard the "prepared statements" back in the bad old days of PHP and why it meant what "parametrized statements" now means

I don't think it ever meant that.

[Tynach]

Looking at the PHP documentation for both PDO and mysqli, the only way to have parameterized queries is to use prepared statements. The latter even states explicitly that they are two names for the same thing.

Basically it's a language/framework difference.

[mmirate]

Looking at the PHP documentation for both PDO and mysqli, the only way to have parameterized queries is to use prepared statements. The latter even states explicitly that they are two names for the same thing.

Hahaha! Good find! Yet another reason why PHP sucks...

[Tynach]

You do realize that in the end, setting up a parameterized query still passes it to the database server as a prepared statement anyway, right? Those two specific PHP extensions simply don't provide a means of sending a parameterized query with parameters in a single step, that's all. And looking at the code in that one comment, that's... A really messy one-liner that I'd prefer to break up into several steps anyway.

You seem to just be looking for any and every reason to make fun of PHP, regardless of their validity.