Re: PEAR Security

Aaron Zampaglione wrote: > Hello, I am relatively new to the php programming world and I have a > question about PEAR. > > > > Does PEAR make my db queries more secure, or is it just a class to make > queries more "organized and easier". > > > > As in what would be the difference (security level wise) between just doing > this: > > (Supposing I striped slashes, escaped strings etc. already.) > > > > > > (Already connected through regular mysql commands) > > ------------------------------------------ > > $sql = "SELECT * FROM USERS" > > $query = mysql_query($sql); > > ------------------------------------------ > > > > As opposed to: > > > > (Already connected through PEAR procedure) > > ------------------------------------------ > > $sql = "SELECT * FROM USERS" > > $query = $db->query($sql); > > ---------------------------------------- Hi Aaron, There is no difference in the way you did it, but your example doesn't matter, as a select query without any outside input is intrinsically secure :). This is a better example: $sql = "SELECT * FROM USERS WHERE user='" . mysql_escape_string($_GET['blah']) . "'"; $query = mysql_query($sql); $sql = "SELECT * FROM USERS WHERE user=?"; $db->query($sql, array($_GET['blah']); However, PEAR doesn't make security any easier, you still have to know what to do. PEAR makes application development easier, and provides simple ways to implement security. By the way, before things get confusing, PEAR encompasses a *lot* of different software. In your example, you really mean "DB" or "MDB2" and not "PEAR" as http://pear.php.net/MDB2 is very different from http://pear.php.net/PEAR. Welcome to the new way of doing things, glad to have you. Greg