Re: PDO prepared statements and LIKE escaping
| From: | Per Jessen | Date: | Mon, 04 Aug 2008 15:47:34 +0000 |
| Subject: | Re: PDO prepared statements and LIKE escaping | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-277675@lists.php.net to get a copy of this message | ||
Larry Garfield wrote:
> Actually in most cases in PHP you don't get much performance.
Exactly.
> What you do get is added security, because prepared statements are
> cleaner than cleaner and more reliable than string escaping. Of
> course, then we run into the % problem above.
I don't really buy that - the string escaping is just a call to a mysql
API, surely that's perfectly reliable.
How do you see prepared statements being cleaner and more reliable?
/Per Jessen, Zürich