Hacker News Reader

Comment by roblabla | Hacker News Reader

PHP (the interpreter) used to be filled with bugs, design flaws and incoherences. It got better lately, but IMO it still caries a huge mess of legacy stuff that shouldn't even exist (mysql_real_escape_string anyone?)

In this case, both the hammer and the hammer's user can be blamed.

View on HN

PHP7 has removed a lot of the old cruft and made some small improvements to PHP's idiomatic syntax.

One great example is the removal of the mysql_real_escape_string function. http://php.net/manual/en/function.mysql-real-escape-string.p...

Another is finally giving us a null coalescing operator, which is a solution for a constant pain point in dealing with raw PHP POST and GET parameters.

The full "new features" list of PHP7: http://php.net/manual/en/migration70.new-features.php

The change log of PHP7+: http://php.net/ChangeLog-7.php

They removed mysql_real_escape_string function so that you can use mysqli_real_escape_string http://php.net/manual/en/mysqli.real-escape-string.php

No, you use PDO::quote().

No, you use

  $pdo->prepare("SELECT id FROM foo WHERE bar = ? AND baz = ?")
      ->execute([$baz, $qux]);

...while taking care to set PDO::ATTR_MODE to PDO::ERRMODE_EXCEPTION and PDO::ATTR_EMULATE_PREPARES to false when your PDO object is initialized.

https://github.com/paragonie/airship/blob/8b7edde11b5b57fcb4...

This is the problem I have with PHP. 15 ways to do something seemingly simple, and only one obscure way is correct (What's PDO::ATTR_MODE ?) And why does PDO try to emulate prepares ?

That was 4 ways. The documentation identify what the options do.

Named parameters are much simpler to use IMO.

Simpler? No. Easier? Yes.

Reply on news.ycombinator.com