|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2005-03-21 09:28 UTC] chriskl@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2026 The PHP GroupAll rights reserved. |
Last updated: Wed Mar 18 02:00:02 2026 UTC |
Feature reqeuest for parametric queries, SQL bind variables, parameterised procedure calls, or whatever people call them ;-) For example pg_query("UPDATE Wibble SET foo=? WHERE wombat=?", $newFoo, $wombat); pg_exec("spAddComment(?,?,?)",$user,$title,$content); A notable feature of these is no need to build dynamic SQL, and remember to addslashes(). Security becomes easier, and if prepared statements can be reused, speed can become better. $stmt = pg_prepare("INSERT INTO Events (date,msg) VALUES (?,?)"); pg_execute($stmt,date(),"Wotzit Flobbled"); ... pg_execute($stmt,date(),"Slime Thoroughly Slaughtered"); (Does PHP have varargs by the way?) Some finer details to sort, due to the way different database backends work. Postgres has stored procedures, but it looks like you SELECT from them, and they behave like functions in other databases. Otherwise though, a good language. - Richard