Hacker News Reader

Will this result in more people using the prepared statements provided in PDO etc.? Then this could reduce the global number of MySQL injection attacks by a noticeable percentage.

View on HN

There is no MySQL injection attack. There is SQL injection attack. And it's not merely a problem of mysql but of how the code that uses mysql is written. And this affect all platforms. You should fix the developers to fix all sql injections.

MySQL queries constitute a signification proportion of SQL queries, and PHP's MySQL extension is responsible for a significant proportion of MySQL queries. It's not a problem of MySQL and it's not even a problem of how the PHP code that uses MySQL is written - the problem is that PHP's MySQL extension doesn't even offer a way to safely prepare a statement. "Fix the developers", in this context, would mean beating them about the head until they remember to mysql_real_escape_string() every parameter every time, and that's obviously not the right approach.

A better approach is to either (1) add a mysql_prepare() function to the PHP MySQL extension, or (2) deprecate the extension in favour of one which forces or at least encourages or at least supports the use of prepared statements.

Reply on news.ycombinator.com