-9

Would it be possible to put a small warning on all questions that get tagged with warning against the use of mysql_* functions in their code?

It seems that every single time a PHP/MySQL question is asked, there is an immediate comment warning of the dangers of using mysql_* functions. This seems very redundant and pointless, when we could notify the users upfront.

All-too-common comment on PHP/MySQL questions on StackOverflow

Does anyone have another idea on how to combat the pointlessness of these comments being posted constantly?

25
  • 3
    THis would be a good addition to the pro-forma comments system that seems to be in the works (no idea when it'll come though)
    – Pekka
    Aug 13, 2012 at 20:50
  • 14
    Why not for everything that becomes deprecated? Don't put ceilings on your dreams
    – random
    Aug 13, 2012 at 20:51
  • 1
    Not sure how sarcastic I should perceive that comment to be...
    – David
    Aug 13, 2012 at 20:51
  • 4
    @David If it's your question, not at all, if it's someone else's question, very.
    – Servy
    Aug 13, 2012 at 20:52
  • That is quite possibly the best answer I could have expected.
    – David
    Aug 13, 2012 at 20:52
  • 10
    It bugs me to read that comment on every MySQL question that uses the old mysql_ functions. Maybe the OP for one reason or another doesn't have access to the newer functions. Even though the mysql_ functions are "discouraged", they're not obsolete or verboten.
    – j08691
    Aug 13, 2012 at 21:08
  • 1
    @j08691 that's very true, but I'm willing to bet with 99% of questioners it's just a case of a bad tutorial (see below)
    – Pekka
    Aug 13, 2012 at 21:13
  • Can someone explain why I've received two downvotes for this? (Used to be at +2)
    – David
    Aug 13, 2012 at 21:14
  • 4
    @Pekka - possibly, but I think there's a difference between discouraging bad coding practices and/or protecting against SQL injections, and making blanket recommendations against using older functions for nothing other than a knee-jerk reaction to seeing the OP using them. It's obviously possible to write clean, secure code using the older mysql_ functions, and while I totally agree with using the newer mysqli_ and PDO options, the comment usually doesn't help the OP.
    – j08691
    Aug 13, 2012 at 21:16
  • @j08691 I agree with your conclusion, albeit for different reasons (see below)
    – Pekka
    Aug 13, 2012 at 21:18
  • @David Most likely because some disagree. (Downvotes often indicate disagreement on Meta SO)
    – Bart
    Aug 13, 2012 at 21:19
  • 7
    This is a slippery slope. There are loads of deprecated functions and practices, covering every conceivable programming language, tool and library. Are we going to cover all of them?
    – user102937
    Aug 13, 2012 at 21:23
  • 1
    @David That said, in this case, I'll throw you a bone; I definitely downvoted, but on Meta, downvoting is different. I disagree with the comment being on every single question I see. At this point, it's useless noise and we're not doing anyone any good. We want to think we're making all database access more secure, but we're really just wasting keystrokes and getting all happy because we think we told someone we know better when in reality, we have no clue what their situation is and how it applies. It's a mutual comment upvote thing.
    – casperOne
    Aug 13, 2012 at 21:24
  • 7
    Disagree. Why would PHP's mysql_ functions get special treatment? Shouldn't the site automatically warn you when you're using split? or any of the other hundreds of deprecated PHP functions? And why stop at PHP? What about deprecation warnings for Perl? Ruby? Python? C? Why stop at deprecation warnings? And what about false-positives, where somebody asks "I've heard that the mysql_* functions are, bad what should I use to replace them?" And who decides on which specific functions get a warning and which don't? Who maintains the list of deprecated functions?
    – user229044
    Aug 13, 2012 at 21:29
  • 1
    @David you have not caused any kind of rift. People downvote things they disagree with on Meta. It isn't personal and you shouldn't take it as such.
    – user229044
    Aug 13, 2012 at 22:15

3 Answers 3

20

There's a lot of related questions coming in so this request makes sense, but on second thought, I'm starting to think it doesn't really matter whether we tell people not to use mysql or not.

The vast majority of users who present mysql_* code have copy-pasted it from some crappy tutorial and are going through the first steps of learning programming. They will not heed the PDO advice. They will not add error checking to their code. They just want to know why it doesn't work and what they need to do to make it work.

If they eventually evolve professionally, they will find out that it's deprecated quickly enough (e.g. by looking in the manual). SO can't be responsible for every crappy tutorial out there. I mean, W3Schools sports SQL injection vulnerabilities in its examples to this day.

Look at this work of beauty for example:

$q=$_GET["q"];

... some code in which they connect to the DB, but do NOT escape $q ......

$sql="SELECT * FROM user WHERE id = '".$q."'";

$result = mysql_query($sql);

That infernal piece of crap site alone leads to more bad code than SO can ever fix.

6
  • I understand what you're saying. My point is, saving commenters the process of posting a pointless comment may be advantageous for the site.
    – David
    Aug 13, 2012 at 21:08
  • @David I totally understand that, and I don't disagree. Don't get me wrong, I've been posting that comment a lot, too ... but I'm starting to tend more towards "it's pointless to comment in the first place"
    – Pekka
    Aug 13, 2012 at 21:10
  • 2
    Most of the people who ask a question with a mysql_* function have less than 100 rep, anyway, making it, like you said, extremely pointless.
    – David
    Aug 13, 2012 at 21:10
  • 2
    I love the examples you see with something like this: $query = mysql_query("SELECT * FROM users WHERE name = " . $_POST['name']);
    – David
    Aug 13, 2012 at 21:13
  • @Pekka WOW. That w3 link is revolting! How can they do that to beginners! I'm pretty sure i've copied w3 stuff when I first started...
    – d-_-b
    Oct 9, 2012 at 0:17
  • I actually want to visit the sites of these people and SQL inject it to teach them a lesson. Happened to me in the very beginning. I learned my lesson about validating input.
    – Cole Tobin
    Apr 15, 2013 at 2:35
1

There, done. This is now part of the MySQL tag wiki for those who so venture to read that page:

Deprecation of mysql_ functions

PHP functions that start with mysql_ have been deprecated as of PHP 5.5.0. If you are in a position to do so, please consider updating your code to use the MySQLi or PDO extensions instead.

But you can only help those who want to be helped or are empowered to effect the change you want to Michael Jackson circa 1988.

-2

Comments like that are just noise and should be flagged as such. They don't help answer the question. It's equivalent to asking:

Where can I get a BLT sandwich?

And the comment is:

Bacon is unhealthy. You shouldn't eat meat. I'm a vegetarian.

12
  • 2
    Are you active enough in that particular tag to be able to judge this?
    – Pekka
    Aug 13, 2012 at 21:33
  • 2
    @Pekka That's my opinion on all "You shouldn't" comments that don't help answer the question. Aug 13, 2012 at 21:34
  • 10
    Strongly, strongly disagree. If people were posting "dont' use mysql_" as an *answer, you would be exactly correct. But posting "you shouldn't do this" messages as comments is not only acceptable, it's a good practice and should be encouraged. It's a great thing when you can save somebody from introducing some terrible code to their app, or point out a potential pitfall they're going to face. Why in the world would you want to stand by and let somebody shoot themselves in the foot, knowing full-well that they're going to hurt themselves and that you could prevent it?
    – user229044
    Aug 13, 2012 at 21:35
  • @meagar It's difficult know an OP's situation well enough from just their question (nor should they have to explain it) to say whether or not they should or should not be doing something. Aug 13, 2012 at 21:39
  • 2
    No, It's really not, I and many others have been doing it for years now and haven't had any trouble with it. Sometimes it doesn't take deep knowledge of somebody's code to see that they're introducing terrible bugs via a single line or short snippet of notoriously broken code.
    – user229044
    Aug 13, 2012 at 21:40
  • 6
    And your example is utter pants. It would be more like somebody asking "Where can I get some bleach and toilet bowl cleaner to whiten my toilet?" and you responding "Don't do that, bleach and toilet bowl cleaner mix to create toxic chloromine gas fumes, you're going to kill yourself". You're saving somebody from a concrete, factual, unambiguously bad thing that they are almost certainly ignorant of. "Bacon is unhealthy" is your opinion, and obviously forcing your unsolicited opinion on others is pretty unwelcome.
    – user229044
    Aug 13, 2012 at 21:42
  • @meagar Those are good points and in the example in this question the comment was very well written and friendly. But many times comments like this are not like that. They are often rude and "You're doing it wrong, idiot." sounding. I have a bias against them. Aug 13, 2012 at 21:47
  • Your example would be valid if I asked "I'd like to make a game using C++" and somebody commented "C++ is bloated. You shouldn't use it. I only program in C". See, that's unsolicited holier-than-though opinion, and it makes you an ass. Telling somebody that a deprecated function is deprecated is not opinion, it's fact, and it is not comparable.
    – user229044
    Aug 13, 2012 at 21:47
  • If you think their comment is rude, flag it as rude. A moderator would instantly delete a "you're doing it wrong idiot" comment. We have a whole rule in the faq about that, and a whole "rude or offensive" flag to deal with it. It has nothing to do with the topic at hand.
    – user229044
    Aug 13, 2012 at 21:48
  • 1
    @meagar Just because a function is deprecated doesn't it shouldn't be used. The OP could be working on legacy code on a server that can't be updated. So saying it's deprecated is not an opinion, but saying they OP shouldn't use it is. Aug 13, 2012 at 21:55
  • 5
    "You shouldn't use deprecated functions" is not opinion. That's why functions are deprecated, that's literally the entire meaning of deprecating a function: Stop using it, it's going away. If the OP wants to head off such comments, he should indicate that he's working with legacy code either in the question or in a comment. I would expect the same from somebody posting obvious buffer-overflow or divide-by-zero errors; if they don't want obvious errors to become the focus of their question, they need to make us aware that they are aware.
    – user229044
    Aug 13, 2012 at 21:58
  • @Pekka I agree with your answer. It's pointless for the reasons you listed. And if it's pointless, I think it's noise. I also agree I don't know anything about this mysql_* issue or its context. But comments like this set the tone for the question in a negative way to everyone that sees it after the comment. It would be simple enough to answer the question the way you think it should be done and also mention why the way they wanted to do it is not a good idea. The comment by itself doesn't add anything. Aug 13, 2012 at 22:13

Not the answer you're looking for? Browse other questions tagged .