Re: [RFC] Name issue - is_literal/is_trusted
| From: | Stephen Reay | Date: | Thu, 24 Jun 2021 10:35:46 +0000 |
| Subject: | Re: [RFC] Name issue - is_literal/is_trusted | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-115108@lists.php.net to get a copy of this message | ||
> On 24 Jun 2021, at 17:16, Craig Francis <craig@craigfrancis.co.uk> wrote:
>
> On Thu, 24 Jun 2021 at 10:55, Stephen Reay <php-lists@koalephant.com> wrote:
>
>> but still I have to keep asking: Why integers at all?
>>
>
>
> While I'm not a fan of this approach, there is a lot of existing code and
> tutorials that use:
>
> $sql = 'WHERE id IN (' . implode(',', array_map('intval', $ids))
> . ')';
>
> $sql = sprintf('SELECT * FROM table WHERE id = %d;', intval($id));
>
> Craig
Yeah you’ve said this about a dozen times now. Parameterisation exists. Query builders that do
this already using parameterisation, exist.