Re: Fwd: MySQLi extension basic examples

I agree here -- the example should be SHOW TABLES as it does not require a variable and then instruct people to use statements with variables. The connection could select the information_schema database because that's always present and then the output is something like CHARACTER_SETS, COLLATIONS, COLLATION_CHARACTER_SET_APPLICABILITY, COLUMNS etc On Mon, Nov 30, 2020 at 10:46 AM Kamil Tekiela <tekiela246@gmail.com> wrote: > Thanks Christoph and Philip. > > The example was mentioned in this bug report > https://bugs.php.net/bug.php?id=77531 and a PR was raised some > time > ago for it https://github.com/php/doc-en/pull/60 > I have even suggested a better example in a reply, but I never got to > writing a proper PR IIRC. I was too busy with other things in my life. > > The problem with that example in regards to SQL injection is that it > doesn't show how to use prepared statements. We can't expect beginners > to know what SQL injection or prepared statements are if we don't show > how to do it properly. Casting to an integer is a quick and dirty > workaround but it's not the recommended practice. The example focuses > on mysqli::query() while people should be using prepared statements > most of the time. Even if no parameter binding is required using them > doesn't hurt. > > I could suggest a proper example, but the question is what should that > example demonstrate? As I said people are usually more interested in > seeing how a particular function works rather than an example that has > little real-life application. If we are going for a quick fix of this > example then we can just replace it with my example from > https://github.com/php/doc-en/pull/60#issuecomment-601976016 > If we want this section in the manual to be a full mysqli tutorial > then it needs much more work, which I really don't think is necessary > given that we have the quick start guide. > > Regards, > Kamil > > On Mon, 30 Nov 2020 at 18:14, Christoph M. Becker <cmbecker69@arcor.de> > wrote: > > > > On 28.11.2020 at 18:08, Kamil Tekiela wrote: > > > > > I would like to hear your opinions about the following page in the PHP > manual: > > > https://www.php.net/manual/en/mysqli.examples-basic.phpûr

¯¥s•+áÀ > > > $gØÙ > > > > > > Currently, this is the only "example" apart from the quick start > > > guide. There is a whole section > > > https://www.php.net/manual/en/mysqli.examples.php > > > which suggests that > > > there were more or that there was meant to be more examples, however > > > there is only that one example now. > > > > > > People have complained about the quality of this example for a number > > > of years, including myself. The page does not show best practices, > > > encourages SQL injection, poor error handling, and lacks prepared > > > statement example. As a result, it does more harm than good. > > > > Why not take the opportunity, and *add* an example which does basically > > the same, but uses prepared statements, and other best practices? > > > > Regards, > > Christoph >