Hacker News Reader

Prepared statements are amazing. Found out about them very soon after I started programming (incidentally my first language was PHP), and switched to PDO right away. This was years ago, I don't understand how people are still using the deprecated and insecure mysql_* functions, you can still find them all over SO and my university "web" class was teaching them as well...

View on HN

You'll be glad to hear that they've finally been removed since PHP 7.0 so slowly but surely they're being consigned to history.

And there seems to be much better awareness about the perils of mysql_* functions amongst PHP devs these days.

However, 5.6 is still in security support until 31st December 2018, so all that bad advice on SO and elsewhere is still relevant and lurking, waiting to be found by inexperienced devs.

As other people have noted, prepared statements aren't a security panacea, and string concatenation you do in the query can be vulnerable.

Reply on news.ycombinator.com