Re: MySQLi extension basic examples

Hi Kamil,

I agree it's an outdated example, but don't understand why user comments reference SQL injection 
in this particular example. I assume they refer to:

if (isset($_GET['aid']) && is_numeric($_GET['aid'])) {
    $aid = (int) $_GET['aid'];
} else {
    $aid = 1;
}
$sql = "SELECT actor_id, first_name, last_name FROM actor WHERE actor_id = $aid";

But $aid is either 1 or casted to an integer, so how can bad stuff be injected? Or perhaps people
are speaking more generally that using a variable _can_ lead to injection if the code does not
properly handle variables.

That said, using prepared statements makes sense so imho I (or you) should update it accordingly.
I personally think adding abstraction layers goes beyond the goal of database extension docs as
in that case folks may as well use PDO or something like Laravel, or use one of the many actively
maintained DB abstraction layers out there.

Regards,
Philip


> On Nov 28, 2020, at 9:08 AM, Kamil Tekiela <[email protected]> wrote:
> 
> I probably should have sent this here
> 
> ---------- Forwarded message ---------
> From: Kamil Tekiela <[email protected]>
> Date: Sat, 28 Nov 2020 at 16:26
> Subject: MySQLi extension basic examples
> To: <[email protected]>
> 
> 
> Hi Internals,
> 
> I would like to hear your opinions about the following page in the PHP manual:
> https://www.php.net/manual/en/mysqli.examples-basic.php
> 
> Currently, this is the only "example" apart from the quick start
> guide. There is a whole section
> https://www.php.net/manual/en/mysqli.examples.php which suggests that
> there were more or that there was meant to be more examples, however
> there is only that one example now.
> 
> People have complained about the quality of this example for a number
> of years, including myself. The page does not show best practices,
> encourages SQL injection, poor error handling, and lacks prepared
> statement example. As a result, it does more harm than good.
> 
> There are two possible solutions. 1. Get rid of the examples section.
> 2. Write a proper mysqli example. While I could create a PR suggesting
> a better example, I would advise that we remove it completely. This
> API is not suited to be used directly in business logic. This
> functionality should be wrapped in a database abstraction layer. For
> this reason, this example is not much more useful than the examples
> located on each function's own page. Users writing abstraction
> libraries are interested more in an example for a particular function
> rather than an overall example.
> 
> What are your opinions? Would it be ok to remove that page?
> 
> Best Regards,
> Kamil Tekiela