From: Doug McNaught <doug@mcnaught.org>
To: Greg Stark <gsstark@mit.edu>
Cc: gearond@cvc.net, "Nigel J. Andrews" <nandrews@investsystems.co.uk>
Cc: pgsql-general@postgresql.org
Cc: pgsql-interfaces@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
Date: 24 Jan 2003 15:24:56 -0500
Message-ID: <m3u1fymh2f.fsf@varsoon.wireboard.com> (raw)
References: <2ZNYVFD2X72ONE0091WQPZXGJEC7WR.3e319071@cal-lab>
<m3y95ami5k.fsf@varsoon.wireboard.com>
<87r8b2nvwr.fsf@stark.dyndns.tv>
Greg Stark <gsstark@mit.edu> writes:
> Doug McNaught <doug@mcnaught.org> writes:
>
> > $stmt = $dbh->prepare("select * from mytable where first_name = ?");
> > $ret_val = $sth->execute("Fred"); # might come from a web form instead
> > @row = $sth->fetchrow_array();
> >
> > The database driver is responsible for turning the '?' in the query
> > into a properly-quoted and escaped value, or otherwise supplying it to
> > the database. The '?' is a placeholder.
>
> Except that that's not what the driver does, at least not for databases that
> are capable of doing better. It sends the placeholders to the database as they
> are. (Or in a different syntax like :1 :2 :3 for Oracle for example.)
Right, but currently for PG (this being a PG list :) it just does the
quoting/escaping and builds the query itself. It's still safer than
doing it by hand, as long as the database driver is trustworthy and
knows the databases escaping conventions.
I think there has been discussion about extending the protocol to
allow Oracle-style prepared statement execution, but right now it
isn't supported. Prepared queries only went in in 7.3, after all...
-Doug
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: doug@mcnaught.org, gsstark@mit.edu, nandrews@investsystems.co.uk, pgsql-general@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
In-Reply-To: <m3u1fymh2f.fsf@varsoon.wireboard.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox