Hacker News Reader

As a part-time PHP hater who often has to work with it professionally, I believe this is a fantastic resource. The bit on databases in particular is something that all PHP devs should read.

That said, it is difficult to bring a legacy code base in line with modern style, though you can improve it over time.

Also, this could benefit from some other gotchas, extremely surprising behavior and best practices for avoiding common pitfalls.

View on HN

On a database section, I am not a fan of PDO and I choose native interfaces like mysqli for my DAO layer or opt for something high level like ORM depending on the requirements.

But it goes without saying that protection from SQL injection is a must, it is just PDO's statement binding is not the only way. MySQLi does support data binding, and for others it is easy to DIY using sprintf and whatever is the escaping method target native driver implements.

DIY and SQL are not two things you want to see together.

You can use PDO to connect and run queries without using all the crazy variable binding features.

Reply on news.ycombinator.com