Drupal like GnuTLS, like openSSL, like joomla, and like a lot of code out there as always been recognized poor quality unreadable code by my own eyes. (Like some parts of the linux kernel)<p>Why don't people see the pattern?<p>Poorly coded software results in security holes.<p>And IN statements are stupid with prepared statement. If you can leverage a «hit or miss» cache effect with a IN statement, you don't need the IN, elsewhise it is inefficient.<p>Good solution is when you can do it: replace IN with join avoiding the shameful pit of Mysql poor performances in subqueries.<p>The other solution is to avoid IN statement because it cannot be protected with the bind trick.<p>And Stackoverflow has the same solutions proposed everywhere, and since people have no critical sense, this bug is everywhere where people are using IN with prepared statement.<p><a href="http://stackoverflow.com/questions/920353/can-i-bind-an-array-to-an-in-condition" rel="nofollow">http://stackoverflow.com/questions/920353/can-i-bind-an-arra...</a>
<a href="http://stackoverflow.com/questions/1586587/pdo-binding-values-for-mysql-in-statement" rel="nofollow">http://stackoverflow.com/questions/1586587/pdo-binding-value...</a>
<a href="http://stackoverflow.com/questions/589284/imploding-a-list-for-use-in-a-python-mysqldb-in-clause" rel="nofollow">http://stackoverflow.com/questions/589284/imploding-a-list-f...</a>
<a href="http://stackoverflow.com/questions/3703180/a-prepared-statement-where-in-query-and-sorting-with-mysql" rel="nofollow">http://stackoverflow.com/questions/3703180/a-prepared-statem...</a>