Re: MySQLi Execute Query RFC
| From: | Craig Francis | Date: | Mon, 25 Apr 2022 11:05:26 +0000 |
| Subject: | Re: MySQLi Execute Query RFC | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-117593@lists.php.net to get a copy of this message | ||
On 22 Apr 2022, at 13:09, Guilliam Xavier <guilliam.xavier@gmail.com> wrote:
> > https://wiki.php.net/rfc/mysqli_execute_query
> > <https://wiki.php.net/rfc/mysqli_execute_query>
>
> Thanks. Maybe add (or even start with) an example of mysqli_query(), to show how
> "migrating to safer" would become easier? retro-fitting your example of parameterised
> query:
Thanks Guilliam, that's a good idea.
To keep it short, I've gone with a more traditional use of
$db->real_escape_string() with string concatenation, including a classic mistake
with missing quotes around integer values :-)
I do like your example with vsprintf(), but I needed to replace the "?" with
"%s" as well, with made it look more complicated than pre-8.1 prepared statements, I hope
that's ok.
Craig