Re: MySQLi extension basic examples

Hi Kamil, Thanks for all of the proposed work on the MySQL documentation as I now see you've created many related pull requests on github. I'll look closer next week and we can figure out how to discuss and implement these changes soon. If you desire help with the commit process (it appears you have a new account and karma to commit to svn) then let me know offlist. Regards, Philip > On Nov 30, 2020, at 10:46 AM, Kamil Tekiela <tekiela246@gmail.com> wrote: > > Thanks Christoph and Philip. > > The example was mentioned in this bug report > https://bugs.php.net/bug.php?id=77531 and a PR was raised some > time > ago for it https://github.com/php/doc-en/pull/60 > I have even suggested a better example in a reply, but I never got to > writing a proper PR IIRC. I was too busy with other things in my life. > > The problem with that example in regards to SQL injection is that it > doesn't show how to use prepared statements. We can't expect beginners > to know what SQL injection or prepared statements are if we don't show > how to do it properly. Casting to an integer is a quick and dirty > workaround but it's not the recommended practice. The example focuses > on mysqli::query() while people should be using prepared statements > most of the time. Even if no parameter binding is required using them > doesn't hurt. > > I could suggest a proper example, but the question is what should that > example demonstrate? As I said people are usually more interested in > seeing how a particular function works rather than an example that has > little real-life application. If we are going for a quick fix of this > example then we can just replace it with my example from > https://github.com/php/doc-en/pull/60#issuecomment-601976016 > If we want this section in the manual to be a full mysqli tutorial > then it needs much more work, which I really don't think is necessary > given that we have the quick start guide. > > Regards, > Kamil > > On Mon, 30 Nov 2020 at 18:14, Christoph M. Becker <cmbecker69@arcor.de> wrote: >> >> On 28.11.2020 at 18:08, Kamil Tekiela wrote: >> >>> I would like to hear your opinions about the following page in the PHP manual: >>> https://www.php.net/manual/en/mysqli.examples-basic.php >>> >>> Currently, this is the only "example" apart from the quick start >>> guide. There is a whole section >>> https://www.php.net/manual/en/mysqli.examples.php which >>> suggests that >>> there were more or that there was meant to be more examples, however >>> there is only that one example now. >>> >>> People have complained about the quality of this example for a number >>> of years, including myself. The page does not show best practices, >>> encourages SQL injection, poor error handling, and lacks prepared >>> statement example. As a result, it does more harm than good. >> >> Why not take the opportunity, and *add* an example which does basically >> the same, but uses prepared statements, and other best practices? >> >> Regards, >> Christoph