Re: Comments on PHP security

From:	Michael Walter	Date:	Fri, 12 Jan 2007 20:10:37 +0000
Subject:	Re: Comments on PHP security
References:	1 2 3 4 5	Groups:	php.internals
Request:	Send a blank email to internals+get-27406@lists.php.net to get a copy of this message

On 1/12/07, Michael B Allen <mba2000@ioplex.com> wrote:

On Fri, 12 Jan 2007 11:40:32 -0500 Robert Cummings <robert@interjinn.com> wrote: On Fri, 2007-01-12 at 15:57 +0000, Tim Starling wrote:
Limits, table names, and several other query parts are protected by MediaWiki's query builder. A complex select query might look like this: $result = $db->select(
    # Tables
    array( 'user', 'revision' ),
    # Fields
    array( 'user_name', 'rev_timestamp' ),
    # Conditions (WHERE)
    array(
        'user_id=rev_user',
        'rev_page' => $page_id
    ),
    # Query tag, goes into a comment in the SQL
    __METHOD__,
    # Options
    array(
        'LIMIT' => 10,
        'ORDER BY' => 'rev_timestamp DESC',
    )
); It even has some degree of DBMS-independence, thanks to creative interpretation of the options parameter. This is what I would like to see in the PHP core.
Wow, that's hideous! Agreed. That's pretty awful. What's wrong with the way Java does things? db->query("select user_name, rev_timestamp from user, revision " .
      "where user_id=rev_user, rev_page=? " .
      "limit 10 query by rev_timestamp desc", $page_id);

This is (partly) missing the point ("Limits, table names, and several other query parts are protected by MediaWiki's query builder. A complex select query might look like this:"). Regards, Michael