Quote:
Originally Posted by Damien
Thought you meant that. Surely some of the bigger layers support actual parametrisation?
|
Not quite. PHP frameworks contain query factory classes that look like ASP.NET parameterisation but it all it does is build the query and then sanitise the input for you.
For example, using a generic query factory class:
$myQuery = $framework->query( "INSERT INTO table ('Name') VALUES(@Name);")
$myQuery->addWithValue("@Name", "punky");
$myQuery->execute();
That looks like ASP.NET but really all it does is it santises "punky" and then does a regexp replace to put it in so it becomes:
"INSERT INTO table ('Name') VALUES('punky');"
And then gets executed. That's all ASP.NET parameterisation does really (except in ASP.NET you can specify types which will throw exceptions if you try and tamper with it) but in that case you are trusting Microsoft to handle it.
Anyway, Raistlin asked about base PHP.