[php-src] Issue #13952: sqlite PDO::quote silently corrupts strings with null bytes
| From: | divinity76 | Date: | Fri, 12 Apr 2024 19:47:42 +0000 |
| Subject: | [php-src] Issue #13952: sqlite PDO::quote silently corrupts strings with null bytes | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-246753@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/13952
Author: divinity76
### Description
The following code:
```php
<?php
declare(strict_types=1);
$db = new \PDO('sqlite::memory:', null, null, array(
\PDO::ATTR_ERRMODE => \PDO::ERRMODE_EXCEPTION,
\PDO::ATTR_DEFAULT_FETCH_MODE => \PDO::FETCH_ASSOC,
\PDO::ATTR_EMULATE_PREPARES => false,
));
var_dump($db->quote("foo\x00bar"));
```
Resulted in this output:
```
string(5) "'foo'"
```
But I expected this output instead:
```
string(17) "x'666f6f00626172'"
```
-or-
```
Fatal error: Uncaught ValueError: PDO::quote(): Argument #1 ($string) must not contain any null
bytes
```
(but preferably the former)
- but SILENTLY CORRUPTING THE STRING is certainly not what I expected, and not the appropriate
course of action.
### PHP Version
PHP 8.3.4
### Operating System
Ubuntu 24.04-beta