I can totally sympathise with the slightly angry tone of this reply, as my post was in a similar vein so I kind of had it coming. You're correct in that this was kind of just a cheap shot and I agree that the community is at least heading in the right direction. You could easily argue that if I really feel so strongly about this issue, I ought to be contacting codular to discuss the issue instead of idly bitching behind their backs on HN.
I do disagree with you on some of your points about tutorials though. You claim it's possible to find such insecure example code for any language, and that's probably true. But is it easy? The first search result for "python mysql tutorial" [1] doesn't contain any SQL injection vulnerabilities. Neither does the first result for "ruby mysql tutorial" [2]. All seems well with "java mysql tutorial" [3] too. Surely the first Google result for "php mysql tutorial" [4] can't be that bad then?
$first=$_POST['first'];
$last=$_POST['last'];
$phone=$_POST['phone'];
$mobile=$_POST['mobile'];
$fax=$_POST['fax'];
$email=$_POST['email'];
$web=$_POST['web'];
mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$query = "INSERT INTO contacts VALUES ('','$first','$last','$phone','$mobile','$fax','$email','$web')";
mysql_query($query);
Ouch. In this case, your point about this being an "old and awful" tutorial does apply. But the tutorials from my original post are new, as in "2013" new. And they were on the front page of HN not one week ago. It's like, finally here comes a fresh-looking new site that looks like it might even have a shot at knocking that garbage from "freewebmasterhelp.com" off the top spot on Google, and it's still not as good as it should be.
The tutorial you linked to shows a date of 1999-2001 (not 2013...). Considering the origins of PHP being predominantly a templating language targeting "webmasters", it's understandable that this link is at the top of the search results. Unfortunate, yes, but understandable.
However, PHP is no longer a templating language. It's a full featured programming language that is used to build a variety of different systems. Trained developers work with PHP every day to build solid, testable and secure code.
There is no excuse for any trained developer to write code like that. Perhaps you shouldn't judge the language just because some untrained idiot put up a bad tutorial.
I just took a quick peek at the Java and Ruby tutorials you linked, and indeed they both talk about prepared statements. Unfortunately for PHP, so many of the tutorials that are still around are very old. We have the same issues with Javascript. If one uses Google to search for a solution to a JS problem, often she or he is confronted with a solution from 1999... which is FAR from today's "best practices". Finding a 10 year old page discussing Python or Ruby connecting to MySQL is nearly impossible due to the newness in these languages in the web arena. (Yes, Zope existed way back when.)
I do agree that the above example is the rule rather than the exception as most books I've owned show something similar or worse:
foreach($_POST as $key => $value) {
${$key} = $value;
}
That's almost as convenient as that magic global form garbage they used to have turned on by default.
I was under the impression though that the MySQLi adapter and PDO both made use of prepared statements. All we need to do now, is clean up the last few years of cruft/misinformation still floating around.
I wasn't angry and didn't mean to come off that way. Text man, emotions just don't come through... unless you use emoticons... which I never do.
But anyway I think we might just view tutorials differently. To me, what's posted above is an outdated, insecure way to put data into a database but it definitely answers the question "how do I put stuff in a databse" simply and right to the point. And that's what I like about PHP tutorials. I'd rather put the onus on the programmer to learn how to put "way to do X' and "way to do Y" together on their own rather than muddy the waters with "here's how to do X but this is important too so let's show you how to do this other thing at the same time".
I do disagree with you on some of your points about tutorials though. You claim it's possible to find such insecure example code for any language, and that's probably true. But is it easy? The first search result for "python mysql tutorial" [1] doesn't contain any SQL injection vulnerabilities. Neither does the first result for "ruby mysql tutorial" [2]. All seems well with "java mysql tutorial" [3] too. Surely the first Google result for "php mysql tutorial" [4] can't be that bad then?
Ouch. In this case, your point about this being an "old and awful" tutorial does apply. But the tutorials from my original post are new, as in "2013" new. And they were on the front page of HN not one week ago. It's like, finally here comes a fresh-looking new site that looks like it might even have a shot at knocking that garbage from "freewebmasterhelp.com" off the top spot on Google, and it's still not as good as it should be.[1] http://zetcode.com/databases/mysqlpythontutorial/
[2] http://zetcode.com/db/mysqlrubytutorial/
[3] http://www.vogella.com/articles/MySQLJava/article.html
[4] http://www.freewebmasterhelp.com/tutorials/phpmysql/4