|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #61004 Add mysql_safe_query
Submitted: 2012-02-07 15:03 UTC Modified: 2012-02-10 16:59 UTC
From: pazzo at bahnhof dot se Assigned:
Status: Wont fix Package: MySQL related
PHP Version: Irrelevant OS: Any
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: pazzo at bahnhof dot se
New email:
PHP Version: OS:


 [2012-02-07 15:03 UTC] pazzo at bahnhof dot se
Since people are bad at securing their code, even when they know how, this 
function may give securer and more readable code:

mysql_safe_query('UPDATE people SET (name, number) VALUES ? WHERE name = ? or ?` 
= ?',
     array('new name', 5553475), 'old name', 'custom field', 5);

I've provided an example of how to solve this using php code.

Test script:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2012-02-08 21:59 UTC] phpmpan at mpan dot pl
Since people rarely refresh their knowledge, even when they know it's old, those links may help realizing that for at least few years there are newer and more secure solutions than old mysql extension:
 [2012-02-09 00:29 UTC]
-Status: Open +Status: Wont fix
 [2012-02-09 00:29 UTC]
ext/mysql is deprecated in PHP 5.4 (albeit without actual PHP warnings until PHP 
5.5). Migrating to mysqli or PDO is strongly recommended at this time, and the 
legacy MySQL extension won't be receiving new features.
 [2012-02-10 08:42 UTC] pazzo at bahnhof dot se
Are you seriously telling me that PHP created a new MySQL interface without 
dealing with the bad design of the queries?
 [2012-02-10 16:58 UTC]
No, what you are describing is prepared statements which are fully supported in 
both MySQLi and PDO. So the new interfaces do exactly what you propose.


Both the ? placeholder style you proposed and the even safer named placeholder 
style are supported:


$sth = $dbh->prepare('SELECT name, colour, calories
    FROM fruit WHERE calories < ? AND colour = ?');
$sth->execute(array(150, 'red'));


$sql = 'SELECT name, colour, calories
    FROM fruit WHERE calories < :calories AND colour = :colour';
$sth = $dbh->prepare($sql);
$sth->execute(array(':calories' => 150, ':colour' => 'red'));
 [2012-02-10 16:59 UTC]
Note that this has been available in PHP since 2005, so it isn't exactly new.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Jul 13 22:01:29 2024 UTC