Re: MySQLi extension basic examples

Hi Everyone, I am just attaching the poll created by CMB to this thread. https://github.com/php/doc-en/pull/278#issuecomment-749852494 Regards, Kamil On Fri, 4 Dec 2020 at 18:54, Philip Olson <philip@roshambo.org> wrote: > > Hi Kamil, > > Thanks for all of the proposed work on the MySQL documentation as I now > see you've created many related pull requests on github. I'll look closer next > week and we can figure out how to discuss and implement these changes > soon. If you desire help with the commit process (it appears you have a > new account and karma to commit to svn) then let me know offlist. > > Regards, > Philip > > > On Nov 30, 2020, at 10:46 AM, Kamil Tekiela <tekiela246@gmail.com> wrote: > > > > Thanks Christoph and Philip. > > > > The example was mentioned in this bug report > > https://bugs.php.net/bug.php?id=77531 and a PR was raised > > some time > > ago for it https://github.com/php/doc-en/pull/60 > > I have even suggested a better example in a reply, but I never got to > > writing a proper PR IIRC. I was too busy with other things in my life. > > > > The problem with that example in regards to SQL injection is that it > > doesn't show how to use prepared statements. We can't expect beginners > > to know what SQL injection or prepared statements are if we don't show > > how to do it properly. Casting to an integer is a quick and dirty > > workaround but it's not the recommended practice. The example focuses > > on mysqli::query() while people should be using prepared statements > > most of the time. Even if no parameter binding is required using them > > doesn't hurt. > > > > I could suggest a proper example, but the question is what should that > > example demonstrate? As I said people are usually more interested in > > seeing how a particular function works rather than an example that has > > little real-life application. If we are going for a quick fix of this > > example then we can just replace it with my example from > > https://github.com/php/doc-en/pull/60#issuecomment-601976016ÈÅß Hú†jCIŠ > > ߈ > > If we want this section in the manual to be a full mysqli tutorial > > then it needs much more work, which I really don't think is necessary > > given that we have the quick start guide. > > > > Regards, > > Kamil > > > > On Mon, 30 Nov 2020 at 18:14, Christoph M. Becker <cmbecker69@arcor.de> wrote: > >> > >> On 28.11.2020 at 18:08, Kamil Tekiela wrote: > >> > >>> I would like to hear your opinions about the following page in the PHP manual: > >>> > >>> https://www.php.net/manual/en/mysqli.examples-basic.php > >>> > >>> Currently, this is the only "example" apart from the quick start > >>> guide. There is a whole section > >>> https://www.php.net/manual/en/mysqli.examples.php > >>> which suggests that > >>> there were more or that there was meant to be more examples, however > >>> there is only that one example now. > >>> > >>> People have complained about the quality of this example for a number > >>> of years, including myself. The page does not show best practices, > >>> encourages SQL injection, poor error handling, and lacks prepared > >>> statement example. As a result, it does more harm than good. > >> > >> Why not take the opportunity, and *add* an example which does basically > >> the same, but uses prepared statements, and other best practices? > >> > >> Regards, > >> Christoph >