#34233 [Asn->Csd]: PDO query parser ignores parameters when surrounded by closed quotes
ID: 34233
Updated by: edink@php.net
Reported By: php at sagi dot org
-Status: Assigned
+Status: Closed
Bug Type: PDO related
Operating System: *
PHP Version: 5CVS-2005-09-02
Assigned To: wez
New Comment:
This bug has been fixed in CVS.
Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
Thank you for the report, and for helping us make PHP better.
Previous Comments:
------------------------------------------------------------------------
[2005-09-04 00:47:59] wez@php.net
Sounds like a greedy regex in our query parser.
------------------------------------------------------------------------
[2005-09-02 11:23:38] php at sagi dot org
Problem still exists with php5-200509020830, pgsql driver.
Did not test with any other driver.
------------------------------------------------------------------------
[2005-09-01 15:15:09] gschlossnagle@php.net
Please try using this CVS snapshot:
http://snaps.php.net/php5-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php5-win32-latest.zip
This works for me in current PHP_5_1 branch using SQLite.
------------------------------------------------------------------------
[2005-08-24 13:23:57] php at sagi dot org
Description:
------------
Running PHP5.1.0RC1, postgresql 8 server with v7.4.7 client libs
(pretty sure native prepared statements are disabled).
When trying to execute this query:
$stmt = $db->prepare("SELECT ('0' || :param || '0')");
$stmt->execute(array(':param' => 123));
PDO actually executes this SQL statement: SELECT ('0' || :param ||
'0'), without replacing :param.
It seems like the parser thinks the whole "0' || :param || '0" part is
quoted, though its not.
The query "SELECT (0 || :param || 0)" works as expected.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=34233&edit=1
Thread (8 messages)