Re: Fwd: MySQLi extension basic examples

Thanks Christoph and Philip.

The example was mentioned in this bug report
https://bugs.php.net/bug.php?id=77531 and a PR was raised some time
ago for it https://github.com/php/doc-en/pull/60
I have even suggested a better example in a reply, but I never got to
writing a proper PR IIRC. I was too busy with other things in my life.

The problem with that example in regards to SQL injection is that it
doesn't show how to use prepared statements. We can't expect beginners
to know what SQL injection or prepared statements are if we don't show
how to do it properly. Casting to an integer is a quick and dirty
workaround but it's not the recommended practice. The example focuses
on mysqli::query() while people should be using prepared statements
most of the time. Even if no parameter binding is required using them
doesn't hurt.

I could suggest a proper example, but the question is what should that
example demonstrate? As I said people are usually more interested in
seeing how a particular function works rather than an example that has
little real-life application. If we are going for a quick fix of this
example then we can just replace it with my example from
https://github.com/php/doc-en/pull/60#issuecomment-601976016
If we want this section in the manual to be a full mysqli tutorial
then it needs much more work, which I really don't think is necessary
given that we have the quick start guide.

Regards,
Kamil

On Mon, 30 Nov 2020 at 18:14, Christoph M. Becker <[email protected]> wrote:
>
> On 28.11.2020 at 18:08, Kamil Tekiela wrote:
>
> > I would like to hear your opinions about the following page in the PHP manual:
> > https://www.php.net/manual/en/mysqli.examples-basic.php
> >
> > Currently, this is the only "example" apart from the quick start
> > guide. There is a whole section
> > https://www.php.net/manual/en/mysqli.examples.php which suggests that
> > there were more or that there was meant to be more examples, however
> > there is only that one example now.
> >
> > People have complained about the quality of this example for a number
> > of years, including myself. The page does not show best practices,
> > encourages SQL injection, poor error handling, and lacks prepared
> > statement example. As a result, it does more harm than good.
>
> Why not take the opportunity, and *add* an example which does basically
> the same, but uses prepared statements, and other best practices?
>
> Regards,
> Christoph