#46408 [Bgs->Opn]: Locale number format settings can cause pg_query_params to break with numerics

ID: 46408 Updated by: lsmith@php.net Reported By: alec at smecher dot bc dot ca -Status: Bogus +Status: Open Bug Type: PostgreSQL related Operating System: Debian testing PHP Version: 5.2.7RC2 New Comment: <RhodiumToad> lsmith: in a parameterized query it's always wrong to use locale-specific delimiters RhodiumToad is also known as Andrew Gierth and is a highly respected expert on #postgresql on freenode. As such I will reopen the bug .. Previous Comments: ------------------------------------------------------------------------ [2008-11-10 17:59:56] alec at smecher dot bc dot ca jani@php.net, please have a look at PostgreSQL's number parsing function (set_var_from_str in src/backend/utils/adt/numeric.c, e.g. at <http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/numeric.c?rev=1.114>). It's hard-coded to expect a period as the decimal separator. Long story short, if you supply a floating point value to pg_query_params and you're using a PHP locale that formats floats with a comma, pg_query_params will generate SQL that will cause a parse error. IMO, the use of a locale-specific float-to-string conversion in PHP's implementation of pg_query_params is the bug. ------------------------------------------------------------------------ [2008-10-31 18:28:57] alec at smecher dot bc dot ca FYI, there's a discussion of the same bug, which also appeared (in a separate implementation) in the implementation of the Pear::DB package: <http://pear.php.net/bugs/bug.php?id=3021> ------------------------------------------------------------------------ [2008-10-28 22:54:37] alec at smecher dot bc dot ca In case it wasn't clear, the bug IMO is that pg_query_params is using a means to convert doubles to strings that is potentially incompatible with the database. ------------------------------------------------------------------------ [2008-10-28 21:35:51] alec at smecher dot bc dot ca Sorry if I've missed something in the documentation, but this definitely looks like a bug to me. I expect pg_query_params, when given a double, to communicate it to the database properly regardless of PHP's number format settings. Could I have a little more feedback? ------------------------------------------------------------------------ [2008-10-28 21:30:50] jani@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/46408 -- Edit this bug report at http://bugs.php.net/?id=46408&edit=1