Req #68856 [NEW]: add arg to odbc_execute() so values not treated as filenames

From: j dot faithw at yahoo dot com Operating system: PHP version: 5.6.4 Package: ODBC related Bug Type: Feature/Change Request Bug description:add arg to odbc_execute() so values not treated as filenames Description: ------------ currently odbc_execute is declared as:- bool odbc_execute ( resource $result_id [, array $parameters_array ] ) But parameters_array has a quirk i.e:- Any parameters in parameter_array which start and end with single quotes will be taken as the name of a file to read and send to the database server as the data for the appropriate placeholder. I suggest that an additional argument be added i.e. bool odbc_execute ( resource $result_id [, array $parameters_array [, mixed $filenames = true ]] ) By default $filenames would be true and the existing functionality will be unchanged. But if false the values in $parameters_array will never be interpreted as filenames. Also $filenames could be an array of true/false values specifying for each element of $parameters_array if the value should be interpreted as a filename. This change would allow odbc_prepare and odbc_execute to be used more often, in particular to help protect against SQL injection attacks which odbc_exec is prone to. -- Edit bug report at https://bugs.php.net/bug.php?id=68856&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68856&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68856&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68856&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68856&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68856&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68856&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68856&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68856&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68856&r=support Expected behavior: https://bugs.php.net/fix.php?id=68856&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68856&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68856&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68856&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68856&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68856&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68856&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68856&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68856&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68856&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68856&r=mysqlcfg