Bug #77490 [Opn->Dup]: PDO does not throw an exception when more values than parameters are used
| From: | nikic@php.net | Date: | Fri, 11 Dec 2020 15:26:01 +0000 |
| Subject: | Bug #77490 [Opn->Dup]: PDO does not throw an exception when more values than parameters are used | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-231024@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=77490&edit=1
ID: 77490
Updated by: nikic@php.net
Reported by: love at sickpeople dot se
Summary: PDO does not throw an exception when more values
than parameters are used
-Status: Open
+Status: Duplicate
Type: Bug
Package: PDO related
PHP Version: 7.3.1
Block user comment: N
Private report: N
New Comment:
Same root cause as bug #79131, which is recently fixed.
Previous Comments:
------------------------------------------------------------------------
[2020-05-06 08:31:27] cmb@php.net
Related To: Bug #79568
------------------------------------------------------------------------
[2019-01-20 00:12:45] love at sickpeople dot se
Description:
------------
When using ERRMODE_EXCEPTION, a call to execute() with *more values* than parameters does not throw
an exception. The call fails with false. The query is not executed by the db.
The docs of execute() states: "Binding more values than specified is not possible; if more keys
exist in input_parameters than in the SQL specified in the PDO::prepare(), then the statement will
fail and an error is emitted."
I've tested this with Mysqlnd.
Test script:
---------------
$host = '';
$db = '';
$user = '';
$pass = '';
$options = [
PDO::ATTR_EMULATE_PREPARES => false, /* required */
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
];
$pdo = new PDO("mysql:host=$host; dbname=$db; charset=utf8mb4", $user, $pass, $options);
$stmt = $pdo->prepare('select ? a, ? b');
try {
var_dump($stmt->execute([0]), $stmt->fetchAll(PDO::FETCH_ASSOC));
}
catch (Throwable $error) {
echo $error->getMessage() . "\n";
}
var_dump($stmt->execute([0, 1]), $stmt->fetchAll(PDO::FETCH_ASSOC));
try {
var_dump($stmt->execute([0, 1, 2]), $stmt->fetchAll(PDO::FETCH_ASSOC));
}
catch (Throwable $error) {
echo $error->getMessage() . "\n";
}
Expected result:
----------------
I expect both execute() with the wrong number of values to throw an exception.
Actual result:
--------------
The last execute() fails with false and does not throw an exception.
Output from the test script:
SQLSTATE[HY093]: Invalid parameter number
bool(true)
array(1) {
[0]=>
array(2) {
["a"]=>
string(1) "0"
["b"]=>
string(1) "1"
}
}
bool(false)
array(0) {
}
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77490&edit=1