Hacker News Reader

Comment by npteljes | Hacker News Reader

You hit the nail on the head, this is exactly why I fell in love with PHP. I learnt it back in the PHP4 days, and it just seemed like the perfectly straightforward way to do web.

In a similar fashion, I abstracted away the database connection, query and returning of results into one lazy-inited function, so talking to the database really was just like

  <?=q("select name from users where id = $userid") ?>

I worked a lot with other languages, none feeling as natural to me as this one, aside from Ruby.

View on HN

Be careful as this syntax can potentially introduce SQL injections.

PHP's parameterization features in PDO can be abstracted so you can turn this into:

  $vars = array(":userid" => $userid);
  q("select name from users where id = :userid", $vars);

It's still pretty concise and is much safer.

Two further alternatives for improved expressiveness:

  q('select name from users where id = :userid', compact('userid'));

  q('select name from users where id = ?', [ $userid ]);

Recommend using single quotes for SQL (command) literals, rather than doublequotes. This helps with discouraging string interpolation (" ... WHERE col = $value "). This also helps very much with SQL quoting object names (tables, columns, indexes, etc) - SQL specifies doublequote (") as the quoting character; for example 'SELECT COUNT(users.id) AS "Number of users" FROM users', or 'CREATE VIEW "My daily report" AS SELECT SUM("count") FROM "some strange table" LEFT JOIN ...'.

Parameterized queries and statements are great. They solve problems where the paramaterized queries are used. However care must be taken, a script running on the database after information has been entered can still inject long after the initial parameterized statement put it into the database if that script itself does not use parameterized queries, making a SQL injection still work, in a delayed way.

Reply on news.ycombinator.com