mignon hunter wrote:
> I'm am trying to find some definitive best practises on database connections with php on both mysql and oracle.
>
> I'm starting to redesign a corporate website and am trying to find out more about security and the best practises for database queries and user input form handling.
>
> For example - what's the best usage - prepared statements? And does it have to be php 5? I need preferably a one stop shop as opposed to looking at dozens of different places. Can you advise a particular book? Website?
>
> I have checked out the security area on the php manual and some users notes - some were useful. But it didnt really have a lot of info and I dont think it is comprehenive or all inclusive.
>
> Thanks in advance. PS I would like to switch the current site from jsp to php. I was going to look into Zend IDE. Comments? Suggestions?
>
> thanks
PHP 5.2 is the way to go for new projects: PHP 4 isn't being
maintained.
Binding/preparing statements is the way to go. Here are quotes about
them with MySQL & Oracle
"They are useful for speeding up execution when you are performing
large numbers of the same query with different data. They also
protect against SQL injection-style attacks." (From "PHP and
MySQL Web Development", 4th Edition, Luke Welling and Laura
Thomson)
"If I were to write a book about how to build nonscalable [note
the NON] Oracle applications, then 'Don't Use Bind Variables'
would be the title of the first and last chapters. [...] If you
want to make Oracle run slowly [...] just refuse to use bind
variables" (From "Expert Oracle Database Architecture", Tom Kyte)
Depending on the site needs, consider a DB abstraction layer or a
framework.
For high performance connections in PHP OCI8 for Oracle, use
oci_pconnect() and pass the character set.
There are a number of Oracle-PHP books available. One free,
introductory one is the "Underground PHP & Oracle Manual",
http://tinyurl.com/f8jad (A new edition will be released in the next
couple of weeks)
Chris
--
Email: christopher.jones@xxxxxxxxxx Tel: +1 650 506 8630
Twitter: http://twitter.com/ghrd Free PHP Book: http://tinyurl.com/f8jad
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
