#35368 [Asn]: PDO query does not work properly with serialize

From: Date: Thu, 24 Nov 2005 16:12:05 +0000
Subject: #35368 [Asn]: PDO query does not work properly with serialize
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-88864@lists.php.net to get a copy of this message 
 ID:               35368
 User updated by:  lists at cyberlot dot net
 Reported By:      lists at cyberlot dot net
 Status:           Assigned
 Bug Type:         PDO related
 Operating System: Centos 4.1
 PHP Version:      6CVS-2005-11-24 (snap)
 Assigned To:      wez
 New Comment:

pdo->quote does not solve the problem either


Previous Comments:
------------------------------------------------------------------------

[2005-11-24 17:02:43] lists at cyberlot dot net

Also tried with sqlite, did not get the same issue.

------------------------------------------------------------------------

[2005-11-24 16:46:13] lists at cyberlot dot net

Recompiled from
--with-pdo --with-mysql
to
--with-pdo --with-mysqli

Still the same issue so its within pdo itself and not some weird
interaction between pdo and mysql library

------------------------------------------------------------------------

[2005-11-24 16:29:41] lists at cyberlot dot net

I tried the same thing using prepare/bind/execute and it does insert
the serialized/escaped string properly with the slashes as expected so
this is limited to a issue with the pdo->query

------------------------------------------------------------------------

[2005-11-24 16:19:25] tony2001@php.net

Assigned to the maintainer.

------------------------------------------------------------------------

[2005-11-24 16:07:36] lists at cyberlot dot net

Description:
------------
If you serialize a string, and run any of the escape functions,
mysql_escape, addslashes you can not use pdo->query to insert and it
does some sort of bind params translation on the string.

Bug exists in php5.1RC4 as I was using that version when I first found
this and upgraded to see if issue was resolved.

Using prepared statements ( and therefore not having to escape the data
before hand ) works.

Reproduce code:
---------------
<?

$dsn = 'mysql:dbname=alpha;host=localhost';
$login = 'alpha';
$password = 'alpha';
$db = new PDO($dsn, $login, $password);
$TEST['test']['test2'] = '1234';
$TEST['test']['test3'] = '555353';
$var = serialize($TEST);
echo "$var\n<BR>\n";
$var = mysql_escape_string($var);
$query = "INSERT INTO sessions SET value = '$var'";
$db->query($query);
$query = 'SELECT value FROM sessions';
$result = $db->query($query);
$row = $result->fetch();
echo $row[0]."\n<BR>\n";
?>


Expected result:
----------------
[root@alpha www_admin]# php index.php
a:1:{s:4:"test";a:2:{s:5:"test2";s:4:"1234";s:5:"test3";s:6:"555353";}}
<BR>
a:1:{s:4:"test";a:2:{s:5:"test2";s:4:"1234";s:5:"test3";s:6:"555353";}}
<BR>


Actual result:
--------------
[root@alpha www_admin]# php index.php
a:1:{s:4:"test";a:2:{s:5:"test2";s:4:"1234";s:5:"test3";s:6:"555353";}}
<BR>
a?:{s?:"test";a?:{s?:"test2";s?:"1234";s?:"test3";s?:"555353";}}
<BR>



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=35368&edit=1

Thread (42 messages)

« previous php.bugs (#88864) next »