Bug #63419 [Com]: PDO::quote for SQLite truncates strings on \0
Edit report at https://bugs.php.net/bug.php?id=63419&edit=1
ID: 63419
Comment by: me at evertpot dot com
Reported by: daniel dot kinzler at wikimedia dot de
Summary: PDO::quote for SQLite truncates strings on \0
Status: No Feedback
Type: Bug
Package: PDO related
Operating System: Ubuntu 11.10
PHP Version: 5.3.18
Block user comment: N
Private report: N
New Comment:
I just noticed the same here with prepared statements. I'm trying to store a serialized PHP
object that contains a 0x00 value. The value gets truncated without warning.
Previous Comments:
------------------------------------------------------------------------
[2014-12-30 10:41:55] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
[2013-10-26 01:58:35] yohgaki@php.net
Related To: Bug #62361
------------------------------------------------------------------------
[2013-10-24 07:30:03] yohgaki@php.net
FYI
quoting is done by PHP, not SQLite, since there is no such API in SQLite3.
------------------------------------------------------------------------
[2013-10-24 07:28:53] yohgaki@php.net
I'm not sure if this change is usable or not.
SQLite3 does not have quote feature. It only has prepared query type API. Even if I change quote
method, it may not work.
Are you sure quote works with null byte escapes? If I were sqlite3 developer, I just don't care
escaped chars, etc, in a SQL string since there should not be such chars in SQL query definition
strings.
If you find out it works, this behavior may be fixed.
------------------------------------------------------------------------
[2012-11-02 11:30:47] daniel dot kinzler at wikimedia dot de
I'd like to add some information about my use case for this. I was storing serialized PHP
objects in the database. Serialized PHP objects seem to use NUL (\0) to mark protected and private
fields. Trying to store such a string into SQLite would truncate it, effectively rendering the
serialized data unusable.
Now, why the hell does PHP use \0 in the serialized representation of objects?! Serializations
should be robust and designed with interoperability in mind! Oh well, I guess that's a rant for
another time.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=63419
--
Edit this bug report at https://bugs.php.net/bug.php?id=63419&edit=1
Thread (9 messages)