Hacker News Reader

> However, for building applications that might get deployed somewhere, or talk to a database in a secure fashion, it's a nightmare.

In what decade? Ever heard of PDO? Prepared statements? PHP is actually more secure when it comes to database connections than all of the wonderful alternatives you mentioned.

View on HN

"Prepared statements? PHP is actually more secure..."

The most commonly used module for mysql access, mysql (not mysqli for some reason), does not support bound parameter prepared statements instead opting for some very funky string escaping business.

Prepared statements are generally the only supported SQL mechanism in other languages/platforms I have used (C, Perl, Ruby, Java, COBOL...)

More secure? Then I suppose I'll get all of the insurance and banking portals to rewrite everything in PHP -- since is so secure and easy to use.

> Then I suppose I'll get all of the insurance and banking portals to rewrite everything in PHP

From COBOL? Probably a good idea.

Reply on news.ycombinator.com