WordPress users out there might find the latest post from Sameer Borate interesting if they're looking to squeeze the most performance out of their installation. It's a guide to using the FirePHP plugin for Firefox to benchmark your WordPress install's SQL.

The first thing you can do to rectify the situation is to find out where exactly the bottleneck resides by analyzing the time each SQL query takes to executes. Some inquisitive people among you may also be interested in knowing in what sequence the Wordpress SQL queries themselves are being run.

His method of benchmarking the SQL for the application uses some of the built in query logging in WordPress and some code dropped into your footer of your template to grab that information and push it back out to the waiting FireBug panel in your browser. The result looks something like this.

WordPress users out there might want to check out this list of SQL queries that could help you solve that problem you've been working on.

WordPress is driven by a MySQL database. This is something active WordPress users would know. However, if you only just read about it here from us, here's what you should know. [...] By simply executing a SQL query against your WordPress database, you can make the necessary changes quickly and efficiently.

The SQL queries cover a wide range of the popular blogging tool's features including:

• Change the Siteurl & Homeurl
• Change a URL in Content
• Change an Image Path Only
• Resetting Password
• Export all Comment Emails with no Duplicate

They also recommend you backup your database before executing any of these statements...just in case (instructions are included for that too).

In a project she's been working on Lorna Mitchell was frustrated with something the CodeIgniter framework does natively - escape SQL statements done through the databaase layer's "select()" method. Thankfully, there was a simple fix to turn this behavior off.

I've been getting increasingly impatient with its tendency to try to escape my SQL code for me - this is a really useful default feature but it seems to assume I don't know what I'm doing and so it puts backticks all over perfectly acceptable SQL code, very annoying!

Thanks to a reply on twitter from damiangostomski to her frustrations she found the optional second parameter you can give the "select()" method, a boolean that tells it whether or not to escape the query (it's mentioned here) for those that were wondering.

In this new post to his KillerPHP.com blog Stefan Mischook looks at a few of the basic steps you can take to help prevent SQL injection attacks in your application.

You should protect your relational databases (like MySQL) from the dreaded SQL injection attack. These attacks are conducted by evil sniveling nerds, trying to insert damaging SQL code into your HTML form fields (and query strings too) to do things like drop database tables or even wipe out your database altogether!

There's three things he recommends as good places to start - mysql_real_escape_string, using an ORM layer with its own escaping and using something like PDO that cleans up the input for you.

Richard Thomas has posted another "Solar Framework Short" for the Solar PHP framework today - this time it's a simple example of setting up SQL profiling.

He includes a code sample that sets up a database object with a custom configuration and calls the "setProfiling" method on it, giving it a value of "TRUE".

This prints out a lovely array with all the queries that have been done. Why is this really useful? Because when using ORM/Model systems the framework builds your queries for you.. This allows you to dig a little deeper, see whats going on, how the queries are being built and were you might need indexes and other changes.

Herbert has submitted a link to his blog that talks about using PHP on the Google App Engine including a wrapper class, pQg.

Google is now supporting 2 languages for Google App Engine: Phyton and Java. [...] Currently focusing on how to use 'normal' SQL in PHP scripts at Google App Engine.

Topics covered so far include:

• Sending email with PHP at GAE
• Creating, retrieving, updating & deleting records in PHP @ GAE
• pQg = PHP with SQL on GAE
• How to use pQg

In a recent post to his blog, Davey Shafik looks at solving something that has "always bugged him about using prepared statements" - getting the actual query it used back out.

Today, a friend asking me if it was possible to get a prepared statement back from PDO with the values placeholders replaced, finally caught me in a moment where I could do something about it. I wrote a thin PDO wrapper class that will [imperfectly, I'm sure] return the completed query.

His class (complete code included in the post) includes a getSQL() method that hands you back the results of your bound parameter query as a string. A few examples of its use are also included.

In a new article on PHPFreaks.com Brad Jacobs takes a look at creating a simple search of the information in your database. Their example will search a table containing article information (title, story content, etc).

The aim of this tutorial is to provide users with a basic layout and the logic behind creating a multiple field search in MySQL. As often time users tend to over do the search and add a lot of unnecessary code. By following and understanding this tutorial you should be able to implement this search into your own site and provide a nice and simple SQL Search of your own database. So roll up your sleeves and be prepared to get dirty.

Everything's provided for you - the SQL to build and fill the tables and the code to perform the search. They opted to go with LIKE statements in the where clause instead of using something like full-text searching. The former works for a lot of situations, but can get slower and slower the more rows there are in the table.

Juozas Kaziukenas (thanks to his work in the WinPHP Challenge) has posted his look at using the SQL native driver to allow the Zend Framework to interact with a MSSQL database backend.

Now some of these issues [that Stuart Herbert pointed out] are fixed, however Microsoft native Sql driver is still not used. [...] However, none of these is available in Zend Framwork. So my task now (because of Winphp competition) is to come up with something what can be used to connect to Microsft Sql database with the new driver.

He looks at how to set up two different options for a database configuration: with a PDO_ODBC adapter and an adapterNamespace setting to define the adapter type to use and the other with an MSSQL adapter type.

The Zend Developer Zone has posted their seventeenth episode in the ZendCon Sessions podcast series today. This time it's Jay Pipes' MySQL-centric talk The Legend of Drunken Query Master.

The ZendCon Sessions are live recordings of sessions that have been given at previous Zend Conferences. Combined with the slides, they can be the next best thing to having attended the conference itself. In this series we will be releasing regular sessions from ZendCon 2008 as we lead up to this year's ZendCon.

You can check out his slides as you listen to the episode either through the in-page player, downloading the mp3 directly or subscribing to the podcast's feed.