[php-src] Issue #8300: Procedural and PDO ODBC don't escape user input when building connection string

From: Date: Tue, 05 Apr 2022 15:25:38 +0000
Subject: [php-src] Issue #8300: Procedural and PDO ODBC don't escape user input when building connection string
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-240668@lists.php.net to get a copy of this message 
Issue: https://github.com/php/php-src/issues/8300
Comment Author: cmb69

From the [SQLDriverConnect
docs](https://docs.microsoft.com/en-us/sql/odbc/reference/syntax/sqldriverconnect-function?view=sql-server-ver15#comments):

> Applications do not have to add braces around the attribute value after the DRIVER keyword
> unless the attribute contains a semicolon (;), in which case the braces are required.

So it looks like only semicolons are an issue.

Thread (1 message)

  • cmb69
« previous php.bugs (#240668) next »