Why no PDO?

[eluser]ipsod[/eluser]
I'm not an expert, so that's why I'm asking.

Why don't CI's database functions use PDO? I did some research on database security, and over and over read that the best way to fortify the database is to use parameterization.

[eluser]ipsod[/eluser]
Ok, besides the theoretical why, should I implement PDO in my site, or can I trust CI's security?

[eluser]Rick Jolly[/eluser]
If you use active record or query binding you are safe since CI uses mysql_real_escape_string() to guard against sql injection. Parameterized queries are similar to CI's query bindings. The advantage to parameterized queries on databases that support them is speed when executing the same query but with different data multiple times. Think multiple inserts. PDO supports parameterized queries on databases that support them, but PDO can also emulate parameterized queries which is the same thing as CI's query binding.

[eluser]JonoB[/eluser]
Have a look at http://www.phpactiverecord.org/

[eluser]ipsod[/eluser]
Thanks JonoB, PHP Active Record looks awesome.

Rick Jolly, I understand that it does, but this site and others like it are what led me to think that that wasn't good enough.

http://bobby-tables.com/

There is only one way to avoid [injection] attacks

* Do not create SQL statements that include outside data.
* Use parameterized SQL calls.

That's it. Don't try to escape invalid characters. Don't try to do it yourself. Learn how to use parameterized statements. Always, every single time.

The strip gets one thing crucially wrong. The answer is not to "sanitize your database inputs" yourself. It is prone to error.

[eluser]Rick Jolly[/eluser]
ispod, rest assured that mysql_real_escape_string() is completely safe. If it wasn't, most php applications would be vulnerable to sql injection attack.

Of course, we developers can screw anything up when we don't know what we are doing.

[eluser]ipsod[/eluser]
Ok, thank you, that's great to know! I'm satisfied with DMZ and glad to not have to change ORM's for security reasons.

[eluser]eBuildy[/eluser]
Its a good question ! Why there are plenty of files for the DB instead of use the fast and very very simple to use ....

All the time I do a new CI projet, I remove all the DB files and add my small PDO wrapper ...

[eluser]EugeneS[/eluser]
[quote author="eBuildy" date="1297183378"]Its a good question ! Why there are plenty of files for the DB instead of use the fast and very very simple to use ....

All the time I do a new CI projet, I remove all the DB files and add my small PDO wrapper ...[/quote]

could you share your PDO wrapper ?

thinking about using Pdo in new project so would like to know if exists any PDO library/driver for CI 2.x or have to create my own from the scratch ?

was trying to find but i cant :\

[eluser]Crag[/eluser]
I don't understand why'd you use the PDO. CI protects you. But you know, there is a filter system in CI too. And you can always use PHP's Sanitize Filters as well.