You will say to use PDO, but these code is so ugly:

$sql=$pdo->prepare("select *
                    from sem_SearchChangeShow
                    where Keyword=:Keyword
                          and BatchNum=:BatchNum
                          and OldChannelID=:ApvChannelID_old
                          and OldCategoryID=:ApvCategoryID_old
                  ");
$sql->execute(array(':Keyword'=>$v['Keyword'],
                    ':BatchNum'=>$v['BatchNum'],
                    ':ApvChannelID_old'=>$v['ApvChannelID_old'],
                    ':ApvCategoryID_old'=>$v['ApvCategoryID_old']
                   )
             );
$tmp=$sql->fetch(PDO::FETCH_ASSOC);

Maybe currently i could write like this:

$sql=eval(safe(
     "insert into z_test (name, value) values ('{$name}', '{#value}')"
     ));
mysql_query($sql);

Or i could write like this:

$_='addslashes';

$sql="insert into z_test (name, value) values ('{$name}', '{$_($value)}')";
mysql_query($sql);

For the most convenience of we php programmers,
maybe we should make a patch to the variable parsing module of double quoted strings in the php engine,
to parse variables, while add slashes to them for such formats: "{#variable_name}",

for example:
<?
$name="myname";
$value="my'value";
echo "insert into z_test (name, value) values ('{$name}', '{#value}')";
?>
we should get:
insert into z_test (name, value) values ('myname', 'my\'value')

Will never happen. You should start using MySQLi and prepared statements.

Or PDO.. :)

Why set this as bogus?

Why don't you realize that the advantage of PHP is right the incredible convenience for web programmers?!

For example, 'substr' is of the best design in all these languages: java, sql, javascript, python, ruby, etc,
...substr($aStr,index_start,length(>=0)/index_after_end(<0))...
that is just the right PHP tradition.

I know PDO and prepared statements is ok,
but those method is really trivial and by no means intuitive.

Why don't you just make a little change to the variable parsing function of the double quoted strings to save we programmers a very enormous time wasting?

In fact, we have no way to reduce the code if we adopt PDO and prepared statements, obviously every variable name apears twice(even apears as a question mark):
$sql=$pdo->prepare("select *
                    from sem_SearchChangeShow
                    where Keyword=:Keyword
                          and BatchNum=:BatchNum
                          and OldChannelID=:ApvChannelID_old
                          and OldCategoryID=:ApvCategoryID_old
                  ");
$sql->execute(array(':Keyword'=>$v['Keyword'],
                    ':BatchNum'=>$v['BatchNum'],
                    ':ApvChannelID_old'=>$v['ApvChannelID_old'],
                    ':ApvCategoryID_old'=>$v['ApvCategoryID_old']
                   )
             );
$tmp=$sql->fetch(PDO::FETCH_ASSOC);

Try to reopen it.

Update expected version to 5.3.2

This is not going to happen.

Rasmus,

Why not have a think about adding addslash function to double-quoted strings?
That maybe the simplest solution for variables replacement in sql query string.

With the addslash function in double-quoted strings, we could code like this:
$rs=$pdo->query("select *
                   from sem_SearchChangeShow
                   where Keyword={#Keyword}
                         and BatchNum={#BatchNum}
                         and OldChannelID={#ApvChannelID_old}
                         and OldCategoryID={#ApvCategoryID_old}
                 ");
$data=$rs->fetch(PDO::FETCH_ASSOC);

But, without it, we have to code like these:
$sql=$pdo->prepare("select *
                   from sem_SearchChangeShow
                   where Keyword=:Keyword
                         and BatchNum=:BatchNum
                         and OldChannelID=:ApvChannelID_old
                         and OldCategoryID=:ApvCategoryID_old
                 ");
$sql->execute(array(':Keyword'=>$Keyword,
                   ':BatchNum'=>$BatchNum,
                   ':ApvChannelID_old'=>$ApvChannelID_old,
                   ':ApvCategoryID_old'=>$ApvCategoryID_old
                  )
            );
$data=$sql->fetch(PDO::FETCH_ASSOC);

Please don't set the feature request to "won't fix".

Rasmus, I insist that the feature request should be reopen, leave it here until some day somebody may make it realized.

Stop re-opening this please.  Escaping needs to be db-specific since different dbs use different escape chars.  Therefore it cannot be done generically at the language level.

OK, maybe there is another solution.

Rasmus,

Similar to this in php.ini file:

//Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = Off

we could add "double_quotes_escape_for_db = mysql" into php.ini.

I still wanna reopen this request very much,

If anybody could realize this that will give PHP a special advantage over other languages.

We are trying to get rid of features like addslashes, not make more similar ones.

Must have a solution in the world.

If we can't build the auto escape for double quotes sql string,
we can build get_caller_vars to realize the simpler auto escape of double quotes sql string.

Changed the title.

Changed the title to "auto escape for variables in double quotes sql string".

auto escape for variables in double quoted sql string

Stop spamming this bug system, you use prepared statements in this case.

Derick,

The problem is right in prepared statements:
$sql=$pdo->prepare("select *
                    from sem_SearchChangeShow
                    where Keyword=:Keyword
                          and BatchNum=:BatchNum
                          and OldChannelID=:ApvChannelID_old
                          and OldCategoryID=:ApvCategoryID_old
                  ");
$sql->execute(array(':Keyword'=>$Keyword,
                    ':BatchNum'=>$BatchNum,
                    ':ApvChannelID_old'=>$ApvChannelID_old,
                    ':ApvCategoryID_old'=>$ApvCategoryID_old
                   )
             );
$data=$sql->fetch(PDO::FETCH_ASSOC);

We need not preparation similar to other languages,
we need immediate escape and parse for varialbles in query strings:
$rs=$pdo->query("select *
                 from sem_SearchChangeShow
                 where Keyword={#Keyword}
                       and BatchNum={#BatchNum}
                       and OldChannelID={#ApvChannelID_old}
                       and OldCategoryID={#ApvCategoryID_old}
               ");
$data=$rs->fetch(PDO::FETCH_ASSOC);

Rasmus,

We really should to get rid of sql string auto escape in data of POST, GET, COOKIE etc,
instead, we put off the sql string auto escape right before the sql string to be executed.

For matching preciseness,
we could only support the format: "...{#BatchId}...",
not to support this format: "...#BatchId...".

We did get rid of it.

Rasmus,

Another way,

similar to reserved word 'global' to inherit variables from global scope, why can't we add a reserved word 'inherit' to inherit varialbes from parent scope?

I think it's very useful since it's a great advantage now aday in javascript communities.

Malcolm

I think to realize auto escape for double quoted strings is easier than to inherit variables from parent scope.

.

,

,

,

As others told you: This feature won't be implemented.

function safe_query($scope, $sql)
         {extract($scope);
          $sql=strtr($sql, array('"'=>'\"', '\\'=>'\\\\'));
          $sql=eval('return "'.preg_replace(array('/\{#(.*?)\}/'), array('".addslashes($\1)."'), $sql).'";');
          mysql_query($sql);
         }
safe_query(get_defined_vars(),
           "insert into z_test (name, value) values ('{$name}', '{#value}')"
          );