#46408 [Opn]: Locale number format settings can cause pg_query_params to break with numerics

From: Date: Tue, 18 Nov 2008 23:16:44 +0000
Subject: #46408 [Opn]: Locale number format settings can cause pg_query_params to break with numerics
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-131084@lists.php.net to get a copy of this message 
 ID:               46408
 User updated by:  alec at smecher dot bc dot ca
 Reported By:      alec at smecher dot bc dot ca
 Status:           Open
 Bug Type:         PostgreSQL related
 Operating System: Debian testing
 PHP Version:      5.2.7RC2
 New Comment:

Thanks, lsmith and RhodiumToad. FYI, this bug also exists in PDO (I can
post reproduce code if it's helpful).


Previous Comments:
------------------------------------------------------------------------

[2008-11-18 22:59:44] lsmith@php.net

<RhodiumToad> lsmith: in a parameterized query it's always wrong to use

locale-specific delimiters

RhodiumToad is also known as Andrew Gierth and is a highly respected 
expert on #postgresql on freenode.

As such I will reopen the bug ..

------------------------------------------------------------------------

[2008-11-10 17:59:56] alec at smecher dot bc dot ca

jani@php.net, please have a look at PostgreSQL's number parsing
function (set_var_from_str in src/backend/utils/adt/numeric.c, e.g. at
<http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/numeric.c?rev=1.114>).
It's hard-coded to expect a period as the decimal separator.

Long story short, if you supply a floating point value to
pg_query_params and you're using a PHP locale that formats floats with a
comma, pg_query_params will generate SQL that will cause a parse error.
IMO, the use of a locale-specific float-to-string conversion in PHP's
implementation of pg_query_params is the bug.

------------------------------------------------------------------------

[2008-10-31 18:28:57] alec at smecher dot bc dot ca

FYI, there's a discussion of the same bug, which also appeared (in a
separate implementation) in the implementation of the Pear::DB package:
<http://pear.php.net/bugs/bug.php?id=3021>

------------------------------------------------------------------------

[2008-10-28 22:54:37] alec at smecher dot bc dot ca

In case it wasn't clear, the bug IMO is that pg_query_params is using a
means to convert doubles to strings that is potentially incompatible
with the database.

------------------------------------------------------------------------

[2008-10-28 21:35:51] alec at smecher dot bc dot ca

Sorry if I've missed something in the documentation, but this
definitely looks like a bug to me. I expect pg_query_params, when given
a double, to communicate it to the database properly regardless of PHP's
number format settings. Could I have a little more feedback?

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/46408

-- 
Edit this bug report at http://bugs.php.net/?id=46408&edit=1

Thread (29 messages)

« previous php.bugs (#131084) next »