From: Greg Stark <gsstark@mit.edu>
To: Nigel J. Andrews <nandrews@investsystems.co.uk>
Cc: Dennis Gearon <gearond@cvc.net>
Cc: Greg Stark <gsstark@mit.edu>
Cc: pgsql-general@postgresql.org
Cc: pgsql-interfaces@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
Date: 24 Jan 2003 14:41:37 -0500
Message-ID: <873cnipc7i.fsf@stark.dyndns.tv> (raw)
In-Reply-To: <Pine.LNX.4.21.0301241914020.28504-100000@ponder.fairway2k.co.uk>
References: <Pine.LNX.4.21.0301241914020.28504-100000@ponder.fairway2k.co.uk>
> On Fri, 24 Jan 2003, Dennis Gearon wrote:
>
> In perl with DBI:
>
> $sth = $dbh->prepare("SELECT * FROM mytable WHERE id = ?");
> $sth->execute($idvalue);
>
> I didn't even know it was possible in PHP. I've never used it before.
Indeed the Perl DBI is quite a bit more solid than the PHP "abstractions". The
syntax is there in PEAR::db:
$db->getall("SELECT * FROM mytable WHERE id = ?", array($idvalue));
but there are a few problems compared to the perl DBI:
a) separating the prepare and the execute is possible but doesn't seem to work
right. If you have two cursors active at the same time it seems to get very
confused.
b) it seems to actually do the substitution itself of the values into the
query which is better than doing it myself but still a lot worse than
giving it to the database out of band. if there's a bug in the PEAR::db
quoting it could still create a security hole.
c) (b) implies it can't be caching prepared query handles so the database has
to parse the query each time. This is a huge lose on big queries, and it's
one of the big advantages to using placeholders other than the security
issues.
d) having to type array() every time is a bit annoying.
--
greg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: gsstark@mit.edu, nandrews@investsystems.co.uk, gearond@cvc.net, pgsql-general@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
In-Reply-To: <873cnipc7i.fsf@stark.dyndns.tv>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox