Hacker News Reader

Comment by Jach | Hacker News Reader

I guess these are okay suggestions, though a few of them aren't going to make a slow piece of code much faster. Micro optimizations result in micro gains. (On getter/setters, I think their uselessness is better grounds for wiping them out than function call speed, but I digress..)

I particularly dislike the glaring SQL Injection error and not using mysqli in the example. They could have at least used a fake escape_data() function around the values if they don't want to use prepared statements. And ignoring that mysqli_query() would be slow called inside a loop, the solution is taking an n loop to a 2n loop. Ah, if only PHP had inline Python generators to reduce it to one...

View on HN

Yes, the SQL example was lame. There are too many PHP "tutorials" which attempt to demonstrate one concept while blatantly ignoring basic security principles. In this case, the example should have used prepared statements with either MySQLi or PDO.

I read "PHP: The Good Parts" on the train last night, and face-palmed the whole way - it's ALL written in an insecure style, except for the one chapter that's explicitly dedicated to security.

Using mysqli* functions would still be a "mistake" if you ask me. PDO exists, and gives you all the benefits of mysqli but with relatvely painless cross-DB support.

This. There is no excuse not to teach PDO from the getgo to newcomers, and I've seen some pretty neat little ORMs built on top of it.

I totally agree that PDO is great. Though I also like the procedural style of mysqli_ functions (don't shoot!). (In Java stuff I have a "object, build yourself from these rows" OOPy pattern.) As for cross-DB support, unless you're using an ORM it's probably going to be painful. Given that some databases conform to ANSI SQL, others (like MySQL) do their own thing, etc., then the issue of built-ins and custom functions (e.g. LucidDB lets you write Java/Jython/Javascript user-defined functions/procedures/transformations) I don't trust any of the SQL strings to work on multiple databases.

PDO's advantage is a standard interface (like JDBC), and if you're planning to ever use more than MySQL with PHP then yes you should use PDO even for MySQL just to get used to the standard.

Reply on news.ycombinator.com