Comments on: You Suck At Programming And I Hate You: Things NEVER To Do In PHP & SQL

By: Eric Muyser

Eric Muyser — Sun, 23 May 2010 14:57:00 +0000

Output Methods Alternative:

$html = <<< EOH

any HTML allowed herer

EOH;

By: Dom

Dom — Fri, 14 Nov 2008 11:18:42 +0000

When I edited php for the first time ever, even I had the common sense to put the html code outside the php tags.

By: David Bernal

David Bernal — Mon, 04 Aug 2008 18:12:35 +0000

Nate:
I do actually mention mysql_real_escape_string, which is like mysql_escape_string, but it takes into account the current character set.

TWD:
That is another good option for formatting your queries. Personally, I find concatenating and using single-quotes easier to read, but that’s more of a style thing. A third option would be to use sprintf.

By: TWD

TWD — Sun, 03 Aug 2008 16:33:36 +0000

Here’s another tip that I see a lot that drives me absolutely nuts: Unnecessarily concatenated strings. PHP provide many great ways to include variables into strings. I would have written your query this way:

mysql_query(”INSERT INTO schools VALUES(’{$busId}’, ‘{$busname}’, ‘{$name}’, ‘{$address}’, ‘{$city}’)”);

By: Nate True

Nate True — Sun, 03 Aug 2008 03:56:22 +0000

You forgot to tell them to use mysql_escape_string in their queries. Without that you’re vulnerable to injection attacks.

(also, magic quotes are a horrible abomination of a security crutch)