TalkPHP - View Single Post - SQL Injection and mysql_real_escape_string

Village Idiot · 05-05-2008, 08:52 PM

Quote:

Originally Posted by wGEric

It is not my programming style. This "style", as you call it, has been around for as long as people have been programming. It is proper code. It is the standard for any programming language to treat variables as the proper type. Yes you can get away with it in PHP/MySQL but that doesn't mean it's correct.

If I looked at your code I would be concerned that you don't understand variable types.

My biggest problem is you are trying to teach people to be lazy programmers and not treat variables with the proper type in SQL queries.

Some languages force types, some dont. Just because C++ or Java force you to keep your types doesnt mean it is bad practice to not do so in PHP. As long as you verify your data like you would have to either way, it is a null point. I am simply taking what I feel is an not needed step out. I am placing a second method that works just as well on the table, people can do whatever they want. You may call it lazy, but it is certainly not. Which one you use is a matter of opinion, simple as that.

Really your could call any efficiency (for lack of a better word, it would be arrogant to call my method that) in programming lazy, but its only bad practice if it leads to messy code or has a downside.