Re: Expose pdo_parse_params to userspace

From: Date: Wed, 11 Oct 2023 15:46:56 +0000
Subject: Re: Expose pdo_parse_params to userspace
References: 1  Groups: php.internals 
Request: Send a blank email to internals+get-121272@lists.php.net to get a copy of this message
Hi, I have to say I am not a fan of this proposal. While definitely a super nice feature in PDO, it's more of a hack rather than proper feature. Certain RDBMSs support named parameters in prepared statements, but MySQL doesn't. Therefore, the solution implemented in PDO is a hack. It's very flawed and the current implementation has multiple bugs and shortcomings. One could say that some bugs are security issues. For the above reason, I don't think we should support this in mysqli. We cannot reliably implement such feature. We could make a copy of pdo_parse_params and fix as many MySQL issues as possible, but we would never be able to fix it fully due to the nature of MySQL API. If someone wants to implement this in userland, then be my guest. As long as you are aware of the shortcomings and you know how to use it safely then it's fine. Unrelated, but I would not consider the async feature of mysqli useful or even a good reason to abandon PDO. IMHO the async feature is a failed experiment with limited applicability. Regards, Kamil Tekiela

« previous php.internals (#121272) next »