Re: Fwd: MySQLi extension basic examples

I agree here -- the example should be SHOW TABLES as it does not require a
variable and then instruct people to use statements with variables. The
connection could select the information_schema database because that's
always present and then the output is something
like CHARACTER_SETS, COLLATIONS, COLLATION_CHARACTER_SET_APPLICABILITY, COLUMNS
etc



On Mon, Nov 30, 2020 at 10:46 AM Kamil Tekiela <[email protected]> wrote:

> Thanks Christoph and Philip.
>
> The example was mentioned in this bug report
> https://bugs.php.net/bug.php?id=77531 and a PR was raised some time
> ago for it https://github.com/php/doc-en/pull/60
> I have even suggested a better example in a reply, but I never got to
> writing a proper PR IIRC. I was too busy with other things in my life.
>
> The problem with that example in regards to SQL injection is that it
> doesn't show how to use prepared statements. We can't expect beginners
> to know what SQL injection or prepared statements are if we don't show
> how to do it properly. Casting to an integer is a quick and dirty
> workaround but it's not the recommended practice. The example focuses
> on mysqli::query() while people should be using prepared statements
> most of the time. Even if no parameter binding is required using them
> doesn't hurt.
>
> I could suggest a proper example, but the question is what should that
> example demonstrate? As I said people are usually more interested in
> seeing how a particular function works rather than an example that has
> little real-life application. If we are going for a quick fix of this
> example then we can just replace it with my example from
> https://github.com/php/doc-en/pull/60#issuecomment-601976016
> If we want this section in the manual to be a full mysqli tutorial
> then it needs much more work, which I really don't think is necessary
> given that we have the quick start guide.
>
> Regards,
> Kamil
>
> On Mon, 30 Nov 2020 at 18:14, Christoph M. Becker <[email protected]>
> wrote:
> >
> > On 28.11.2020 at 18:08, Kamil Tekiela wrote:
> >
> > > I would like to hear your opinions about the following page in the PHP
> manual:
> > > https://www.php.net/manual/en/mysqli.examples-basic.php
> > >
> > > Currently, this is the only "example" apart from the quick start
> > > guide. There is a whole section
> > > https://www.php.net/manual/en/mysqli.examples.php which suggests that
> > > there were more or that there was meant to be more examples, however
> > > there is only that one example now.
> > >
> > > People have complained about the quality of this example for a number
> > > of years, including myself. The page does not show best practices,
> > > encourages SQL injection, poor error handling, and lacks prepared
> > > statement example. As a result, it does more harm than good.
> >
> > Why not take the opportunity, and *add* an example which does basically
> > the same, but uses prepared statements, and other best practices?
> >
> > Regards,
> > Christoph
>