Hector Martin

Btw, someone joked about http://php.net  having this as the correct solution, and, well. But "knowing better than http://php.net " is definitely a prerequisite to be in the security business writing PHP. Or just don't write PHP.https://twitter.com/marcan42/status/1089238169839489025 …

Not sure that it's PHP that's at fault. You could write this same problem in pretty much any language

But most other programming languages don't teach people to make this mistake in their *official documentation*.

Don't disagree. I was referring to your latter point of "don't write PHP"

so continue to write in a language that is unsafe by default and the official docs don't help you either....why? do you also eat soup with a fork?

Show me a language that doesn't allow you to concatenate strings and use the result as a query. The docs are a problem, sure, but it's the developers and the education. It's not the language, and the language shaming was boring 10 years ago, it still is today

Culture matters. The problem is that a newbie trying to learn PHP and googling for answers is going to come across much lower quality code than a newbie learning something like Python. Even with the recent core PHP fixes, this is a problem the PHP community may never solve.

(And the docs are evidence of the problem being systemic and severe; if the docs are this bad, imagine how much worse all the random blogs are!)