Hacker News Reader

Those comments appear to be based on an older version of the page. The current page doesn't have most of those "optimizations."

Edit: And confirmed. See http://web.archive.org/web/20090628004019/http://code.google...

View on HN

The issue of "copy-on-write" ..still here, in addition to the potential SQL Injection vulnerabilities in the sample code.

The example they gave ($description = strip_tags($_POST['description']);) would trigger copy-on-write, unless I'm mistaken.

And the SQL example isn't meant to be copy/pasted: it's a demonstration of a fairly common anti-pattern that has nothing to do with SQL escaping. Adding escaping there would just confuse the point.

The problem, like with all bad code examples, is that people copy and paste it without thinking and don't look back if it runs, so here we are in 2011 with SQLi holes in literally every other website.

Either write a complete, secure example or don't write an example at all. Like a colleague of mine said, putting incomplete code samples on the Internet is like handing out loaded Glocks to children; expect feet and heads to be blown off. I wouldn't even write a toy example with mysql_query anymore because the number of footnotes required (that people would ignore) would fill a page.

Reply on news.ycombinator.com