note 122019 added to function.pg-escape-string

Please, as a service to the Internet, add a note advising developers to use prepared statements and placeholders, and deprecate this function and its friends (but not pg_escape_identifier). There is no valid reason to mix data and SQL into a single string before sending it to the RDBMS, and thus create the potential for SQL injection vulnerabilities. Hence, there is no need to escape data. Hence, there is no need for this function. It's confusing to offer developers functionality that they don't need and shouldn't use. ---- Server IP: 208.43.231.9 Probable Submitter: 150.203.248.36 ---- Manual Page -- http://php.net/manual/en/function.pg-escape-string.php Edit -- https://master.php.net/note/edit/122019 Del: integrated -- https://master.php.net/note/delete/122019/integrated Del: useless -- https://master.php.net/note/delete/122019/useless Del: bad code -- https://master.php.net/note/delete/122019/bad+code Del: spam -- https://master.php.net/note/delete/122019/spam Del: non-english -- https://master.php.net/note/delete/122019/non-english Del: in docs -- https://master.php.net/note/delete/122019/in+docs Del: other reasons-- https://master.php.net/note/delete/122019 Reject -- https://master.php.net/note/reject/122019 Search -- https://master.php.net/manage/user-notes.php