Req #76647 [Com]: PDO's query parser should warn with multiple named parameters
Edit report at https://bugs.php.net/bug.php?id=76647&edit=1
ID: 76647
Comment by: ashumalikh758 at gmail dot com
Reported by: requinix@php.net
Summary: PDO's query parser should warn with multiple named
parameters
Status: Open
Type: Feature/Change Request
Package: PDO Core
PHP Version: 7.3.0alpha4
Block user comment: N
Private report: N
New Comment:
Education Exam News are sharing latest news about education, exam, study, college and university,
school, teaching, learning etc. More info to visit our website:
(https://educationexamnews.com)github.com
Previous Comments:
------------------------------------------------------------------------
[2021-09-28 12:25:35] cmb@php.net
Related To: Bug #48856
------------------------------------------------------------------------
[2021-09-28 12:20:01] cmb@php.net
> If PDO is not emulating prepares and a query contains named parameters,
> SELECT a FROM b WHERE c = :param OR d = :param
>
> it will get rewritten to use placeholders
> SELECT a FROM b WHERE c = ? OR d = ?
This is driver specific. If the driver supports either parameter
style (e.g. PDO_SQLite), there is no need to call
pdo_parse_params(), so the query won't be rewritten.
> Some appropriate error message or PDOException during
> $pdo->prepare().
Maybe we should generally emit a notice if the query is rewritten?
Otherwise the following code will successfully execute with
emulated prepares, but not with native prepares (PDO_MySQL,
PHP-7.4):
<?php
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, $emulate);
$stmt = $pdo->prepare('SELECT :a as foo, :b as bar');
$stmt->execute([1, 2]);
?>
Or is this a particular glitch of PDO_MySQL?
------------------------------------------------------------------------
[2018-07-19 15:15:10] requinix@php.net
Related To: Bug #76639
------------------------------------------------------------------------
[2018-07-19 15:11:11] requinix@php.net
Description:
------------
From bug #76639.
If PDO is not emulating prepares and a query contains named parameters,
SELECT a FROM b WHERE c = :param OR d = :param
it will get rewritten to use placeholders
SELECT a FROM b WHERE c = ? OR d = ?
When the user executes the query they will only provide one value, and that results in an error
because the query requires two values. MySQL/pdo_mysql gives "SQLSTATE[HY093]: Invalid
parameter number", which is technically correct but only understandable if the user knows about
the rewriting. It also happens during the call to execute(), which is misleading as the problem was
actually in the prepared statement given to prepare().
The docs for PDO::prepare() do speak of this:
> You cannot use a named parameter marker of the same name more than once in a prepared
> statement, unless
> emulation mode is on.
The request: Since PDO is parsing and rewriting queries during prepare(), it can recognize this
situation happening and so should present a meaningful error message/exception at that time.
Test script:
---------------
<?php
$pdo = new PDO(...);
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$pdo->prepare("SELECT :param, :param");
?>
Expected result:
----------------
Some appropriate error message or PDOException during $pdo->prepare().
Actual result:
--------------
Query is accepted and prepared even though it can't be executed.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=76647&edit=1
Thread (3 messages)