Re: Re: MySQLi Execute Query RFC
| From: | Guilliam Xavier | Date: | Fri, 22 Apr 2022 12:09:26 +0000 |
| Subject: | Re: Re: MySQLi Execute Query RFC | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-117569@lists.php.net to get a copy of this message | ||
Hi Craig,
> https://wiki.php.net/rfc/mysqli_execute_query
>
Thanks. Maybe add (or even start with) an example of mysqli_query(), to
show how "migrating to safer" would become easier? retro-fitting your
example of parameterised query:
```
$sql_format = "SELECT * FROM user WHERE name LIKE %s AND type IN (%s, %s)";
/* ... */
$sql_raw = vsprintf($sql_format, array_map(fn ($s) => "'" .
$db->real_escape_string($s) . "'", [$name, $type1, $type2]));
foreach ($db->query($sql_raw) as $row) {
print_r($row);
}
```
Regards,
--
Guilliam Xavier