Re: Mysqli improvements
| From: | Craig Francis | Date: | Thu, 31 Dec 2020 11:28:21 +0000 |
| Subject: | Re: Mysqli improvements | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-112695@lists.php.net to get a copy of this message | ||
Hi Kamil,
I like these proposals, especially error reporting, which I've got caught
out with before:
https://bugs.php.net/bug.php?id=78932
As to "add bind-in-execute to mysqli", by passing an array of parameters to
mysqli_stmt::execute(), this is something I'd really like to see.
I just wonder if we could take it a little further, so a query can be
executed with parameters with one function/method? which is what I was
proposing last week:
https://news-web.php.net/php.internals/112618
https://marc.info/?l=php-internals&m=160898181628407
Only because I'd like the "right way" to also be the easiest/fastest way,
on the basis that developers just want to get the job done, and the
simplest way should be the best way.
Today, I still see a lot of this:
$name = ($_GET['name'] ?? '');
$sql = 'SELECT * FROM user WHERE name LIKE "' . $name . '"';
$result = $mysqli->query($sql);
while ($row = $result->fetch_assoc()) {
}
Yes, not even using error prone (flawed) escaping - something we can
address in "phase 2" :-)
I suspect (heavy sarcasm implied) it's because it's so much easier than
this monstrosity:
$name = ($_GET['name'] ?? '');
$sql = 'SELECT * FROM user WHERE name LIKE ?';
$statement = $mysqli->prepare($sql);
$statement->bind_param('s', $name);
$statement->execute();
$result = $statement->get_result();
while ($row = $result->fetch_assoc()) {
}
So I really like how you've avoided the difficult bind_param() method, with
it's annoying $types string, and pass-by-reference issue, so it looks a bit
more like:
$statement = $mysqli->prepare($sql);
$statement->execute([$name]);
$result = $statement->get_result();
while ($row = $result->fetch_assoc()) {
}
I really hope you can do this - as it allows the developer to re-issue the
prepared statement by calling execute() again.
But I'd still like to go a little bit further, so we can get $result in a
single function/method call, like the original (flawed) approach:
$result = $mysqli->execute($sql, [$name]);
while ($row = $result->fetch_assoc()) {
}
Craig
On Wed, 30 Dec 2020 at 18:33, Kamil Tekiela <tekiela246@gmail.com> wrote:
> Hi Internals,
>
> I would like to start a discussion about possible improvements to the
> mysqli API. I have written an RFC which explains all my ideas.
>
> https://wiki.php.net/rfc/improve_mysqli
>
> As the RFC is nothing more than a concept at the moment I am looking
> for some feedback. I attempted to implement some of the changes myself
> but due to my limited experience with C and PHP internals I didn't get
> far. I would appreciate if some volunteer would like to help me to
> implement the changes once they are ironed out.
>
> I understand that the RFC will need to be split up before voting.
>
> Kind regards,
> Kamil Tekiela
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>
>