Is it really nesseccary to PREPARE statements with PHP's mysqli? - php

Question

At the moment I have some database wrapper functions like so:
function db_escape($str) {
return mysql_real_escape_string($str);
}
function db_query($sql) {
global $LINKID;
return mysql_query ($sql, $LINKID);
}
function db_fetch_array($result) {
return mysql_fetch_array ($result, MYSQL_ASSOC);
}
In my code I can then do things like:
$result = db_query('SELECT userid, first_name, last_name FROM user
WHERE email = "' . db_escape($email) . '"');
if ($result) {
$user = db_fetch_array($result);
}
One of the ideas behind this is that when I switch from mysql to mysqli, it'll take just a few minutes to update my wrapper functions and I don't have to replace hundreds of instances of mysql_real_escape_string(), mysql_query() and mysql_fetch_array() across hundreds of different projects.
The only issue with this is that the above can translate to standard procedural mysqli functions easily enough, but not prepared statements.
Does this matter? It seems like every tutorial says prepared statements are important for security and performance, however at the moment:
None of my projects have performance issues.
I am extremely anal about casting user input to the expected type (string, integer, float, etc.) and also manually escaping any user input that's used anywhere in a query.
With this in mind is it really necessary to switch to prepared statements, for either past or future projects?

Answer 1

I think you should think about the long term benefit. For example, if in the future you are no longer the developer of that project, the habit of using non-prepared statement will be passed down to the next developer and this:
I am extremely anal about casting user input to the expected type (string, integer, float, etc.) and also manually escaping any user input that's used anywhere in a query.
may not be true anymore. And even though you say you're very careful, at some point you will make mistake or forget (yes people did! and that's why things break) then it will be an issue.
Think about the following case as an example. Do you think it's safe ?
$id = $_POST['id'];
$result = db_query('SELECT userid, first_name, last_name FROM user
WHERE userid = ' . db_escape($id) );

Answer 2

Although I feel somewhat irritated seeing yet another Mr. Smart who come up with his Perpetuum Mobile, I cannot call his ideas totally unreasonable to some degree. But, unfortunately, they are all based on the wrong assumptions.
Which are
SQL formatting rules are limited to escaping and casting
whatever protection from SQL injection required
such a protection should be applied to user input
every PHP application is small and observable
like it was mentioned in the other answer, only one developer, who keeps all the code in his head, ever works on the project.
But again, all these assumptions are wrong.
As soon as you rethink them, you will come to conclusion that only the parameterized query can give you an insurance bill. Note that I am talking of the general idea of using parameters, not particular implementation used in mysqli. One can have the idea implemented even with old mysql ext all right.
Another thing to think of is code beauty and size. Look what you have now
$result = db_query('SELECT userid, first_name, last_name FROM user
WHERE email = "' . db_escape($email) . '"');
if ($result) {
$user = db_fetch_array($result);
}
and what it can be using parameters
$sql = 'SELECT userid, first_name, last_name FROM user WHERE email = ?';
$user = db_fetch_array($sql, $email);