In my years of experience with web development, I finally see that someone shows a practical example of why not using prepared statements is a bad idea. Without too much talking, right to the point. You might say "oh, but there are countless tutorials out there" - not a lot of them are understandable enough. Stop talking so much, show me a proof of concept and off we go. This is one of them - practical examples, no fuss. If developers were to stick to the point and show proofs of concept, they could rake in thousands for their tutorials. This is underrated.
@ProgramWithGio3 жыл бұрын
Thank you so much 🙏
@BradyRussell-sb3ng Жыл бұрын
This was extremely comprehensive and useful. A lot of tutorials just assume that stuff will work, but this actually goes into the stuff that could go wrong and why.
@ProgramWithGio Жыл бұрын
Happy to hear that, thank you
@rickybarabba78663 жыл бұрын
This PHP course is the BEST around without any shadow of doubt!!!
@ProgramWithGio3 жыл бұрын
Thank you 🙏
@federicobau86512 жыл бұрын
Great example of SQL injection and the use of PHP PDO overall. I did not know about ATTR_EMULATE_PREPARES, that's really good stuff
@yinonelbaz5309 Жыл бұрын
The first video I've come across that really shows what query injection is and why it's dangerous
@ProgramWithGio Жыл бұрын
Glad you like it, thank you
@mariomilunovic2 жыл бұрын
So far, the best explanation and demonstration of the sql injection mechanism.
@ProgramWithGio2 жыл бұрын
Thank you 🙌
@sharifurrobin77203 жыл бұрын
Enjoyed it every video you have made in this series, the way you have explained its rare in many tutorial. Love you brother ❤️❤️❤️
@ProgramWithGio3 жыл бұрын
Thank you so much ❤️❤️❤️
@NedumEze2 жыл бұрын
Every time I re-watch this video, I am stunned by your dexterity, Gio. Thanks. Many points you made addressed issues that have long repeatedly hurt me. I appreciate
@ProgramWithGio2 жыл бұрын
Really glad to hear that. Thank you Adolf 🙌
@devtest82592 жыл бұрын
This was extremely informative and useful. I know how to parameterize queries in c# and python, and was surprised at how different It is to do in php. This very clearly explains a lot and I love the injection example. This video allowed me to go from the unsecured stone age of regex-replace to something Secure I can be happy with.
@ProgramWithGio2 жыл бұрын
Glad it was helpful, thank you 💙
@ifetmartinovic4 ай бұрын
Jedan od najboljih pojasnjenja PHP PDO-a
@ProgramWithGio4 ай бұрын
Thank you
@Zubbee2 жыл бұрын
Copied some prepared statements in my small procedural php application. Knew that it helped with something called SQL injection but I didn't understand it. Then, I didn't know about the named arguments. I had question marks (?) all over the place. I was having to count them to be sure I had enough when things didn't work. Wow. This is a lot to take in. Even my computer knows that I'm learn many new things 😂. I want to watch again and again, but since I'm close to the end of section 2, I'm going to move on. I'll be back! (Terminator voice). Thanks Gio
@ProgramWithGio2 жыл бұрын
You're welcome 💙💙
@jessedeboer23013 жыл бұрын
Awesome series, haven’t seen anyone like you. Keep it up :)
@ProgramWithGio3 жыл бұрын
Thank you 🙌
@2008rol2 жыл бұрын
I like how you explain in sql injection. Awesome. I hope you will have a series of web security on writing php such as sql injection, CSRF, XSS etc.
@ProgramWithGio2 жыл бұрын
Thank you. We'll touch some security related topics in 3rd section
@user-zh2oz9fe4m Жыл бұрын
This channel helped me improve my skills drastically. Thanks!
@ProgramWithGio Жыл бұрын
Happy to hear this 💙
@tedybg2 жыл бұрын
GIO are you a teacher? A wonderfully organized lesson with essential material! Again, great explanation of PDO connection and setup via Docker :) Recommended!
@ProgramWithGio2 жыл бұрын
No I'm not, this is actually my first attempt at teaching if you can believe it. Thank you very much, it means a lot 💙
@tedybg2 жыл бұрын
@@ProgramWithGio You are doing great! You were born to do it. I enjoy watching your tutorials. Thank you!
@ProgramWithGio2 жыл бұрын
@@tedybg thank you, that means a lot. Glad you like it 🙌💙
@jeevachaithanyansivanandan3 жыл бұрын
Wow. That's SQL injection explanation is awesome.. thank you
@omaryahia10 ай бұрын
going into the source code of the PDO extension to see if the ":" colon was optional or not was just 👌🏻☺ I like that
@ProgramWithGio10 ай бұрын
Heh, glad you liked that 💙
@ts4life7833 жыл бұрын
Thank you for this video, PDO explained vividly
@ProgramWithGio3 жыл бұрын
You're welcome, glad you enjoyed it
@zeeu Жыл бұрын
Everything in this course is GREAT 😎
@ProgramWithGio Жыл бұрын
Thank you 💙
@hassanag.dd.369 Жыл бұрын
You're awesome! I've just commented here about a tiny typo, when using date you put it to "Y-m-d H:m:s", but minutes are not `m`, this will write the month. it is `i` as u know. Thank you very much again.
@ProgramWithGio Жыл бұрын
Thank you, yea typed too fast :)
@fairouzben40434 ай бұрын
Great explanation , thank you
@ProgramWithGio3 ай бұрын
You are welcome!
@socialcodia12023 жыл бұрын
Wow , Nice Explanation Sir. ❤️
@abdihakimguliye82073 жыл бұрын
Thanks man for the explanation. Part 2 waiting 💪
@ahtritcodes721910 ай бұрын
A very detailed in-depth explanation. Besides php documentation is there any other resource that would help to grasp all these concepts at such an in-depth level? Thank you in advance !!
@ProgramWithGio10 ай бұрын
phpdelusions is a nice site
@adrianstefan18143 жыл бұрын
I found your channel yesterday and it seems great! Are your actual videos sufficient to get started with Laravel (if I watch all and code until the last one)? Also amazing work!!
@ProgramWithGio3 жыл бұрын
Thank you. You could get started with Laravel even without watching my lessons, Laravel is just that awesome :). That being said though, watching these lessons will definitely help you understand Laravel better & make it easier to understand some of that hidden magic. And that applies to any other framework, not just Laravel. If I was starting out & had the time, I would first learn PHP & MVC, then move on to Laravel. This is one of the reasons why I am putting so much time into this series, I started it about 8 months ago & still going. I want to make sure that important details & topics are covered.
@YT_Watcher4 ай бұрын
excellent content❤
@ProgramWithGio3 ай бұрын
Thank you 🙌
@baptistedara80262 жыл бұрын
the best teacher ever in PHP but could you try to speak just a little bit slower, for those who like me are not native English speakers splease
@ProgramWithGio2 жыл бұрын
Thank you. Yes I improved on that in 3rd section, for older videos you can slow it down on KZfaq by selecting the playback speed 💙
@VS-nh1qp3 жыл бұрын
Thank you for continuing this course, it is the best on the network, starting from scratch ... The only thing that I would like to improve is after each video, at least to have links to tasks for practicing training skills for different operations, functions, etc., such as a - codewar, or come up with your own tasks, or get it from somewhere else .. for example - w3resource.
@ProgramWithGio3 жыл бұрын
Thank you. That is a good suggestion, we will work on a project where you'll get to practice pretty much everything we've covered. But I'll see if I can make some exercises for other videos and post links
@demarenko Жыл бұрын
Thanks man, this explanation was very useful!
@ProgramWithGio Жыл бұрын
Glad it helped 🙌
@ganeshb.y.7732 Жыл бұрын
Thanks Gio for your great explainations
@ProgramWithGio Жыл бұрын
You're welcome, thank you 💙
@abdallakaram53763 жыл бұрын
The great Gio for ever ♥️♥️♥️
@NedumEze3 жыл бұрын
Wonderful revelations, for me. You demystified a lot for me today. Please, in this series, try out the SELECT A, B WHERE Match(A,B) Against("GIO PDO") Clause with PDO in searching the database. I have been struggling with it. Can't get it to work for me!
@ProgramWithGio3 жыл бұрын
Glad it was useful. Are you getting any errors?
@NedumEze3 жыл бұрын
@@ProgramWithGio Mystery errors, yes. Bottom line binding parameters for execution is near impossible! 1) I enter a string in the Search field. 2) Sanitize the string. 3) Seek results by searching two or more database columns/fields indexed for FULLTEXT Search. 4) Binding Parameters right in the Match () Against () WHERE clause is impossible with PDO. If you would permit me, I would send you my code, and errors screenshots. Maybe, you would spot what I am doing wrong! The Queries run easily in PHPMyAdmin environment directly in the Database.
@ProgramWithGio3 жыл бұрын
@@NedumEze yea send it to me if you can and I'll take a look. I personally haven't used match/against much, but I would be happy to take a look and see if I can spot something. Try disabling emulated prepares and see if that helps, I know that you can't use placeholders in some statements like with LIMIT for example when emulated prepares are enabled, so might be the same issue
@NedumEze3 жыл бұрын
@@ProgramWithGio Here's my email: adolfce@gmail.com. Use it to give me yours, so that I can send you the Code, please. Emulation is disabled, right in my Constructor, in the options array.
@ProgramWithGio3 жыл бұрын
I've sent you an email
@memack1012 жыл бұрын
Thank you.
@ProgramWithGio2 жыл бұрын
You're welcome!
@devnullex2 жыл бұрын
Awesome series!!!!!
@ProgramWithGio2 жыл бұрын
Thank you 🙌
@farhan_aftab3 жыл бұрын
Keep Making these videos Thanks
@ProgramWithGio3 жыл бұрын
You got it!
@emekatimothyiloba699 Жыл бұрын
Gioooo. Thank you bruv
@ProgramWithGio Жыл бұрын
You're welcome
@user-tb9fi7rs8r Жыл бұрын
thank you!!!
@ProgramWithGio Жыл бұрын
You're welcome
@EgorDemeshko6 ай бұрын
ty)great info)
@ProgramWithGio6 ай бұрын
Glad it was helpful!
@robertoverbey32022 жыл бұрын
Why is the database recording the time as 21:07:00 rather than 21:00:00 as listed in the date(strtotime()) function? I know it isn't a core concept of the video, but I am curious. Great videos by the way. They are a little fast paced for me but I realize others may be more familiar with all of the concepts and therefore appreciate the fast pace while someone such as myself has the opportunity to pause, rewind, or watch the entire video again.
@ProgramWithGio2 жыл бұрын
Thank you. That is because I have a typo there in the date format, I use H:m:s it should be H:i:s (m) is for month so 7 is the month # because its July. I pointed out the typo at 15:03 on the left corner. About the pace yea I heard from few others that it's a bit fast for which I apologize, I try to slow down as much as I can but it's just the way I tend to speak seems like :). Will surely improve on that. One thing that has helped others is adjusting the playback speed on KZfaq to slow it down.
@user-mo3cw6go7c Жыл бұрын
❤❤❤❤❤
@ProgramWithGio Жыл бұрын
💙💙💙
@pauliusjankauskas80283 жыл бұрын
Hey, your courses are really informative. Thanks Question: do you have any public plan what will be in later course lessons or when will start third part (advanced) and what will cover it?
@ProgramWithGio3 жыл бұрын
Hello, yes in the first video of the course you can see the overview of the topics for all three sections. There are just one or two more videos left for the 2nd section and then we'll begin the third, I am going to make another overview video that will explain what to expect in the 3rd section.
@ryanford516 Жыл бұрын
4:41 Gio, when you use "db" as your hostname it has to be resolved to an actual IP address when the script runs, doesn't it? I wonder what the actual IP would be in this case.
@ProgramWithGio Жыл бұрын
Happens behind the scenes, you can check your docker container's ip, there is a command for it I think. Should be able to google it
@yanushevitz55882 жыл бұрын
How it happens that if you do $db->query($query), you have to fetch it, but in foreach loop you don't have to?
@ProgramWithGio2 жыл бұрын
query method returns PDOStatement which implements IteratorAggregate that allows it to be iterated over in loops.
@FranciscoJunior292 жыл бұрын
Cool, it's awesome.
@ProgramWithGio2 жыл бұрын
Thank you
@amijazz19417 ай бұрын
MySQL on my host machine (Ubuntu 20.04) is running on port 3306, and our container is also running on Port 3306. So, will there be a port conflict or not?
@ProgramWithGio7 ай бұрын
I think it will conflict yes
@muzosh Жыл бұрын
If emulated prepares are slower and return types as string instead of int and floats why would you use them even in Development? when return types could be important in your application when you're expecting a return type int for example.
@ProgramWithGio Жыл бұрын
I didn't say it's slower, I said "possible performance boost", that boost is probably very negligible. There are uses for emulated prepares but I personally try to disable them when I can and use native ones.
@superheroshortss8 ай бұрын
Can we use now doc to store query string in $query?
@ProgramWithGio8 ай бұрын
You could but make sure to use prepared statements
@Armando-px8hi Жыл бұрын
So Gio please explain, when you put in the dns the db using docker, I am using xampp what do I need to use to correctly connect to the db.
@ProgramWithGio Жыл бұрын
localhost should work
@Armando-px8hi Жыл бұрын
@@ProgramWithGio Yeah it worked bro, I had made another mistake. Thank you!
@gatzmamora1178 Жыл бұрын
Hey, would anyone happen to know how to use the PDO class with XAMPP to a remote Microsoft SQL Server/Database? I've tried a lot of different methods over the past few days with no luck.
@ProgramWithGio Жыл бұрын
I'm not sure I understand what you are trying to do. You want to connect to remote Microsoft SQL DB using PDO? You can use SQLSRV DSN, check this part in the docs www.php.net/manual/en/ref.pdo-sqlsrv.connection.php
@desenvolvendoumprograma7198 ай бұрын
Is there any reason to use emulated prepared statement?
@ProgramWithGio8 ай бұрын
For drivers that don't natively support prepared statements yes. This is the note in the official documentation: "Some drivers do not support prepared statements natively or have limited support for them. If set to true PDO will always emulate prepared statements, otherwise PDO will attempt to use native prepared statements. In case the driver cannot successfully prepare the current query, PDO will always fall back to emulating the prepared statement."
@godmansarah2 жыл бұрын
Awesome refresher and also new tips here, thanks! Do you personally prefer to use PDO:ATTR_EMULATE_PREPARES = false?
@ProgramWithGio2 жыл бұрын
Depends on the project & scope. Php 8.1 will no longer strigify the integers & floats which it was before when using emulated prepares so even with emulated prepares it should return integers & floats as their native types instead of strings.
@igor9722 жыл бұрын
Hey Gio, whats the beneffits of using bindParam over bindValue? When to use one over other?
@ProgramWithGio2 жыл бұрын
One does by reference, other by value. I don't use bindParam much, to me it's harder to read and understand what's going on given that it is by reference, so I stick to bindValue.
@igor9722 жыл бұрын
@@ProgramWithGio Thank you so much!
@a.aspden Жыл бұрын
I am still a bit confused at how using binding or any other method of constructing a statement helps sanitize user input data and protect from injection. Can someone help explain this or direct me to a better explanation?
@ProgramWithGio Жыл бұрын
It's not about sanitizing, using prepared statements handles the proper escaping for you to prevent sql injections. You can read about prepared statements in MySQL, just Google it and plenty of articles will come up or even the official docs.
@hakeamgureh24413 жыл бұрын
For PDO::FETCH_CLASS mode where do you pass the $classname argument?
@ProgramWithGio3 жыл бұрын
In your fetch method. So $pdo->fetchAll(PDO::FETCH_CLASS, YourClass::class). You can also use setFetchMode to fetch the mode to class like this: $stmt->setFetchMode(PDO::FETCH_CLASS, YourClass::class);
@hakeamgureh24413 жыл бұрын
@@ProgramWithGio thank you so much Gio
@johongirrahimov23432 жыл бұрын
Hi Gio, When I run query to database it's throwing error like the one below, Could you help me please? PDOException: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'my_db.users' doesn't exist in /var/www/public/index.php:13 Stack trace: #0 /var/www/public/index.php(13): PDO->query('SELECT * FROM u...') #1 {main}
@ProgramWithGio2 жыл бұрын
Hello. It means table doesn't exist, did you create table? You can refer to the intro to MySQL lesson to learn how to create tables
@web95223 жыл бұрын
is PHP dead?
@ProgramWithGio3 жыл бұрын
Nope, not dead at all. I wouldn't be spending hundreds of hours making this course if it was dead 🙂
@php34183 жыл бұрын
You know what therr are languages from 60s and 70s and didn't die yet .. But imagine when taking about the language thag runs more than 40% of thd web ? .. It's an entire language for the web development not just a framework like django or node anf while some node kids make fun of it we earn money using it .. And it also has very powerful updates Even the key advantage of node against php is gone LOL now there is a library called guzzle which can make php async like node js
@securecodingdevelopment50233 жыл бұрын
@@ProgramWithGio the capacity of this dinosaur or mastodon, with respect to its experienced code for security domains, the speed that has been increased with JIT, and the options of synchronization in real time as you indicated or ReactPHP, make it a powerful language .....
@will10cent Жыл бұрын
hello, please how to use prepared statement for embedded statement , like select from ... where param1 = ? and param2 in (select from where param3 = ? ) . Is this possible? thanks a lot
@ProgramWithGio Жыл бұрын
Hello. Yes that's possible and you would use it just like that. Write the query and use placeholders the same way.
@will10cent Жыл бұрын
@@ProgramWithGio thanks for the reply. I've tried it but had some errors, especially with inner join, etc ..
@ProgramWithGio Жыл бұрын
@@will10cent can you share the exact query and the error you get?
@will10cent Жыл бұрын
@@ProgramWithGio I will try to reproduce it on monday and come back at you, thanks a lot for the help
@will10cent Жыл бұрын
@@ProgramWithGio now i have it. When you have a variable for example $sports = ["soccer", "bball"]; and you try something like , select ... where sport in $sports; and i tried to parametize $sports, it didn't work. Questions are: 1- is that a vulnerable code 2- how to parametize it
@rustamergashev72782 ай бұрын
👍
@ProgramWithGioАй бұрын
💙
@AbdouAbdou-hu9un Жыл бұрын
thanks lot, very helpful material. I've tested the emulated prepares, but nothing is any different from when they are disabled (I got the output of the SELECT query with integers values, and I could use the same name for three named parameters where one is in the LIMIT clause) ****CODE I wrote****
@ProgramWithGio Жыл бұрын
PDO falls back to emulated prepares if it cant prepare natively, so that's probably why you don't see difference. Did you try disabling the emulated prepares? Cause I don't see emulated prepares disabled in above code.
@AbdouAbdou-hu9un Жыл бұрын
@@ProgramWithGio that worked, thank you Gio, now I understand.
@bijianwu5124 Жыл бұрын
thanks again for the amazing video! by the way, is using PDO:FETCH_CLASS to do database object map to my own defined class object a recommended way? is it too slow, etc.
@ProgramWithGio Жыл бұрын
I wouldn't worry about performance much. It should be fine, that's how ORMs work. If you prefer to work with objects instead of arrays & keys then yes that's what you would use to directly hydrate your own objects. Another way is to hydrate objects yourself
@bijianwu5124 Жыл бұрын
@@ProgramWithGio thanks, that makes sense
@PietervandenHombergh2 жыл бұрын
why use root for the app. you loose all kinds of features dealing with grants on tables and views. better is to have a dba role (ie root) and a different user that has rights on the database objects.
@ProgramWithGio2 жыл бұрын
This is a local development setup. For production I agree, you would not want to use root.
@JLarky2 жыл бұрын
15:46 explains that SQL injections are bad, then proceeds to add one just in case. And here I thought that people finally started writing secure PHP code in 2022. Nope, 15 years later (since I started) everything is the same.
@ProgramWithGio2 жыл бұрын
Check beginning of part 2. I explain it there. I should've removed this part from the recording but decided to leave it in and address it in part 2. It's not SQL injection but I agree it should be using params instead of putting in integer value in the query.
@truthteachers Жыл бұрын
Bro, at timestamp 12:16, the SQL injection worked in your example because the code for query string is delimited by a single quotes. But when i used double quotes the SQL injection does not work and nothing is returned.
@ProgramWithGio Жыл бұрын
Then you need to use double quote in query as well and it will work. The point is you don't know what user might submit, they can brute force it & submit various strings formatted in different ways
@bishalshrestha90912 жыл бұрын
Every Time I use $GET_[ '..' ] or $_POST[ '..' ] I encounter a error of Undefined array key and I solved the error for POST using isset but I cannot solve GET with isset for eg if(isset($_GET['email'])) { $email = $_GET['email']; } I'm getting error saying Undefined variable $email but if I use $email = $_GET['email']; then ' Undefined array key "email" ' this error is displayed PS: I'm using php 8.1.4
@ProgramWithGio2 жыл бұрын
Because if email isn't set then variable email never gets defined. You should define email variable before if statement and assign to blank value for example or add the else statement and set email to blank there or whatever logic you want to do when email isn't set. Other option: $email = $_GET['email'] ?? '';
@bishalshrestha90912 жыл бұрын
@@ProgramWithGio Thanks Gio.
@danielmung9600 Жыл бұрын
Fatal error: Uncaught PDOException: SQLSTATE[HY000] [1049] Unknown database 'my_db' in /var/www/app/DB.php:31 Stack trace: #0 /var/www/app/App.php(15): App\DB->__construct(Array) #1 /var/www/public/index.php(26): App\App->__construct(Object(App\Router), Array, Object(App\Config)) #2 {main} thrown in /var/www/app/DB.php on line 31 I had error i created BD name by my_db, but it is error how can i solve
@ProgramWithGio Жыл бұрын
Are you sure you created DB under the same connection? Are you using Docker or XAMPP?
@danielmung9600 Жыл бұрын
I use Mysql on mac
@ProgramWithGio Жыл бұрын
@@danielmung9600 check your connection configuration, the error says there is no DB so probably wrong connection or something, maybe typo in DB name? I haven't used Mac so I'm not sure if there is any other configuration involved