(Dec 27, 2013 06:46 PM)Knar. Wrote: I thought we were done explaining why using PDO or MySqli over native mysql functions is better.
Learning PDO and MySqli would be learning it right, why would you learn the old stuff when you can learn the new stuff? Sure he might learn why PDO is better over the old mysql api, but there is no need for that as he is just starting. All he needs are the basics.
I am saying that telling someone about it and telling him it's wrong and giving reasons. People absorb the knowledge in a 2D format. They will remember it as a set of rules rather then becoming part of their logic. Education equals gaining now logic and training equals set of instructions.
It's fine for now for him to use PDO or MYSQLi but I just want him at a later time to take the time and learn about the security holes that MYSQL had.
There's a big difference between you telling me that this is bad and isn't standard to me reading about it and doing a lab about it. It's testing and making sure you fully understand the concept and logic about the matter.
Learning this will get you to learn how to write your own PDO or MYSQLi. I am saying if you fully understand the problem and issue at hand and how the PHP team solved the problem. It adds on logic to your brain. You can avoid any problems or issues in the future.
I am saying what if 5 or 10 years from now you get bored with writing apps and software and you decided to write your own programming language. Learning this will help you understand a little more about security and vulnerabilities in all aspects in programming. It don't matter if you're programming your server for a website or you're making an app for your computer or an app for a cellphone. Or making your own electronic hardware. Knowing these concepts right now will make you a better programmer and make you write clean secure code. As long you understood the fundamentals.
If you think just because HF members on here told you that you shouldn't do this and it's because it's bad. You won't fully understand why and therefor you will always follow that advice like if it's the bible. So, whenever you code you will follow those exact instructions. However, what if a new flaw comes later on which this same advice is no longer secure. Someone found a flaw with this advise. Or what if the advice no longer is valid and in then next 10 years you end up having additional things more after finding out some more flaws.
I am just saying if you want to learn something properly and right. You go on all out. That is why I learned about it and wrote my own functions to deal with the problem and issue.
Also if you want to insert code like SQL queries. You still filter them. You don't let SQL language constructs stored in the database instead replace them with something else. So when grabbing it from the database you can reconstruct the query code and just out it in html. The logic you should be looking at is what can someone do to input code that will run.
If you fully understood the issue you would't be asking me such a question. The core logic to this issue is what if someone inputs code. How can I filter that input to not allow it to run as code but instead store it as text. So, no matter what is thrown at your server it won't run as code. That is what this is all about. Key word always filter inputs so no code can run from the inputs.
Once you understand the problem and issue fully and understand the solutions. You may never use this in your life but it makes you a better programmer. If for some reason at some point in your life you might want to write your own programming language or make or create your own electronic device. The logic is the same or maybe you want to be a hacker. You will have to think in the same way how can I bypass the protections of a server, of a electronic device of a program. This is the fundamental concepts in protecting your programs or websites from being hacked or tampered with results that wasn't designed by you or allowed.
So, it will help you in all aspects in programming but not just in programming you can use this knowledge also in engineering. If you want to engineer anything to secure objects or add security to a device. You will have to think the same way which is how would someone get unauthorized access to what you don't want anybody to have access to it.
So, learning this will help you as a programmer. However, You still need to use MYSQi or PDO because PHP is going to use these two and will no longer support MYSQL.
So, I am saying he can use MYSQLi or PDO for now but should learn when he gets a chance to do some labs and play around with SQL injections.
I learned what I know from actually doing the labs. I knew it wasn't something you should do but at the time I learned about it was when everyone just found out about SQL injections. The PHP team went to work for a solution. While they did that I read articles about it and then done projects to learn about it. I then created my own solutions before the PHP rolled out MYSQLi and PDO.
Doing my own labs and rolling out my own solution made me become a better programmer. Since I understood the issues at hand. If I just sat and wait for the PHP team to come up with a solution which most ended up doing. I would't know exactly what they did to solve this solution.
I am just saying as programmers you will have these issues at some point in your life again maybe not exactly SQL injections but think about other types of code that could run from your inputs. the PHP team made a fundamental mistake. Why should you ever make such mistakes?
I am just letting OP know to be a better programmer you always need to know what are the problems programmers faced and what was the solution to those problems. Once you understand you will write more safer code and if you understood the logic of how we got to such a solution. You then can apply it to any project you have. If you don't understand the problem and the solution. Then if later down the road you have to write something yourself without using libs or others solutions you will make the same mistakes that the people that worked on PHP did. You also will lose respect from other programmers because you will look like a skid or someone at a low level. Yes, some may mock you for making such a mistake and it's not because they're mean. It's because they don't take you serious. If you're serious you will always look for better ways to write your code and better ways to secure it from possible hacks or getting results that you never intended your code should do.
👍
