So, someone pointed me at http://www.simplemachines.org/community/index.php?topic=453157.0 - it's not even officially by a current team member and yet it's still the closest thing to a guide for 2.1 that anyone outside the team has.
Funny, it's almost as if he read through Wedge's feature list, you know.
I mean:
* Database Support
* Browser Support
* CSS3 & jQuery Implementation
* Bloated Profile Fields
These are things we've actually done already in Wedge, almost word for word.
Then the other stuff that is listed is stuff that has been talked about here, and it seems there is a lot of common ground there, you know, almost as if he'd been reading the forum...
Though I think he's talking out of his ass with PDO. While, yes, PDO does offer some things, sanitisation isn't exactly one of them (though, there is a valid argument to be made that prepared statements can deal with it for the most part), moving it to use PDO "just because" isn't really a good idea - and less hosts have PDO installed. There is an argment for making it an object, which we did, and are likely to expand on in the future.
I take exception, however, to:Quote I'm assuming that he's referring to the db_insert stuff where you have to state the column type. Unfortunately for him, he's actually wrong on at least two counts where it can't be determined safely by PHP, though I will admit both cases are fairly rare.[1][2]
That, and the fact that you do actually have to state the list of columns you're inserting anyway, unless you're inserting an exact row into the table with all values added, and all columns in the exact same order.
Last but not least, I can't see them ever adding ReCaptcha, not least because that's a third party service and they don't use third party services (ever) in the core, but that it's unreliable at very best. I prefer our CAPTCHA, in all honesty, and I'm not saying that because I wrote it.
Also if you want a laugh, they have a new board dedicated to discussion of what's in the next version. Took them long enough.
Mind you, there's still some absolute gems such as http://www.simplemachines.org/community/index.php?topic=375491.msg3165582#msg3165582 - if he thinks it's that simple, I'd love to see him write it.
Funny, it's almost as if he read through Wedge's feature list, you know.
I mean:
* Database Support
* Browser Support
* CSS3 & jQuery Implementation
* Bloated Profile Fields
These are things we've actually done already in Wedge, almost word for word.
Then the other stuff that is listed is stuff that has been talked about here, and it seems there is a lot of common ground there, you know, almost as if he'd been reading the forum...
Though I think he's talking out of his ass with PDO. While, yes, PDO does offer some things, sanitisation isn't exactly one of them (though, there is a valid argument to be made that prepared statements can deal with it for the most part), moving it to use PDO "just because" isn't really a good idea - and less hosts have PDO installed. There is an argment for making it an object, which we did, and are likely to expand on in the future.
I take exception, however, to:
but this can be figured out with PHP very easily, with no need to declare each column.
That, and the fact that you do actually have to state the list of columns you're inserting anyway, unless you're inserting an exact row into the table with all values added, and all columns in the exact same order.
Last but not least, I can't see them ever adding ReCaptcha, not least because that's a third party service and they don't use third party services (ever) in the core, but that it's unreliable at very best. I prefer our CAPTCHA, in all honesty, and I'm not saying that because I wrote it.
Posted: September 21st, 2011, 01:11 AM
Also if you want a laugh, they have a new board dedicated to discussion of what's in the next version. Took them long enough.
Mind you, there's still some absolute gems such as http://www.simplemachines.org/community/index.php?topic=375491.msg3165582#msg3165582 - if he thinks it's that simple, I'd love to see him write it.
| 1. | They are bigint and set/enum cases where the individual values are numeric. In the former case, PHP may munge the data if it's bigger than 2^52 and on a 32 bit setup, and in the latter, if provided as numeric it won't encapsulate the data and will likely cause a query error. In both cases, the data should be sent in quotes, you know, using the string type. Been there, done that. |
| 2. | Mind you, if it were to assume that everything was a string instead and *always* quote everything in the SQL, which is perfectly valid in MySQL even for integers (which it isn't in other DB systems, which is why it's done the way it's done), you could skip specifying both, and just pass everything to the quote function, but that does have a slight performance implication on things that insert a lot of numbers, which is more common than you'd think. |
