Re: MySQLi extension basic examples

Hi Everyone,

I am just attaching the poll created by CMB to this thread.
https://github.com/php/doc-en/pull/278#issuecomment-749852494

Regards,
Kamil

On Fri, 4 Dec 2020 at 18:54, Philip Olson <[email protected]> wrote:
>
> Hi Kamil,
>
> Thanks for all of the proposed work on the MySQL documentation as I now
> see you've created many related pull requests on github. I'll look closer next
> week and we can figure out how to discuss and implement these changes
> soon. If you desire help with the commit process (it appears you have a
> new account and karma to commit to svn) then let me know offlist.
>
> Regards,
> Philip
>
> > On Nov 30, 2020, at 10:46 AM, Kamil Tekiela <[email protected]> wrote:
> >
> > Thanks Christoph and Philip.
> >
> > The example was mentioned in this bug report
> > https://bugs.php.net/bug.php?id=77531 and a PR was raised some time
> > ago for it https://github.com/php/doc-en/pull/60
> > I have even suggested a better example in a reply, but I never got to
> > writing a proper PR IIRC. I was too busy with other things in my life.
> >
> > The problem with that example in regards to SQL injection is that it
> > doesn't show how to use prepared statements. We can't expect beginners
> > to know what SQL injection or prepared statements are if we don't show
> > how to do it properly. Casting to an integer is a quick and dirty
> > workaround but it's not the recommended practice. The example focuses
> > on mysqli::query() while people should be using prepared statements
> > most of the time. Even if no parameter binding is required using them
> > doesn't hurt.
> >
> > I could suggest a proper example, but the question is what should that
> > example demonstrate? As I said people are usually more interested in
> > seeing how a particular function works rather than an example that has
> > little real-life application. If we are going for a quick fix of this
> > example then we can just replace it with my example from
> > https://github.com/php/doc-en/pull/60#issuecomment-601976016
> > If we want this section in the manual to be a full mysqli tutorial
> > then it needs much more work, which I really don't think is necessary
> > given that we have the quick start guide.
> >
> > Regards,
> > Kamil
> >
> > On Mon, 30 Nov 2020 at 18:14, Christoph M. Becker <[email protected]> wrote:
> >>
> >> On 28.11.2020 at 18:08, Kamil Tekiela wrote:
> >>
> >>> I would like to hear your opinions about the following page in the PHP manual:
> >>> https://www.php.net/manual/en/mysqli.examples-basic.php
> >>>
> >>> Currently, this is the only "example" apart from the quick start
> >>> guide. There is a whole section
> >>> https://www.php.net/manual/en/mysqli.examples.php which suggests that
> >>> there were more or that there was meant to be more examples, however
> >>> there is only that one example now.
> >>>
> >>> People have complained about the quality of this example for a number
> >>> of years, including myself. The page does not show best practices,
> >>> encourages SQL injection, poor error handling, and lacks prepared
> >>> statement example. As a result, it does more harm than good.
> >>
> >> Why not take the opportunity, and *add* an example which does basically
> >> the same, but uses prepared statements, and other best practices?
> >>
> >> Regards,
> >> Christoph
>