PHP 4.0 Bug #4200: OCIBindByName is unable to bind strings of Zero Length

From: jnield@impole.com Operating system: Linux 2.2.5 (Redhat 6.1+Patches) PHP version: 4.0 Release Candidate 1 PHP Bug Type: Oracle related Bug description: OCIBindByName is unable to bind strings of Zero Length When using OCIBindByName, strings of zero length can't be bound. This is a major problem for me because I use bind-variables for input from the user, to prevent the input from being interpreted as SQL. It must be possible to insert a string of zero length. Whether that is treated as NULL or not should be left to the database if possible. It seems that this change between 3.1.14 and 4.0 RC1 occurred because strings are now being passed to the OCI C library's OCIBindByName() as type SQLT_CHR instead of SQLT_STR. OCIBindByName() does not seem to accept a value of 0 for 'value_sz' when the type is SQLT_CHR, and there is no '\0' at the end of the string to look for. Let me know if there's anything I can do to help. This is preventing us from really testing RC1. /* EXAMPLE SCRIPT 1 (assume $conn is an open connection) */ $val = ""; $stmt = OCIParse($conn, "select ''||:v_bind||'' from dual"); OCIBindByName($stmt, ":v_bind", &$val, -1); /* comes from ->value.str.len */ /*** RESULT: Warning bindlength == 0 (Correct behaviour as in 3.1.14) */ OCIExecute($stmt); /*** RESULT: ORA-01008 not all variables bound (problem...) */ OCIFreeStatement($stmt); /* EXAMPLE SCRIPT 2 */ $stmt = OCIParse($conn, "select ''||:v_bind||'' from dual"); OCIBindByName($stmt, ":v_bind", &$val, 0); /* Explicitly of zero length */ /*** RESULT: ORA-01009: missing mandatory parameter */ OCIExecute($stmt); /*** RESULT: ORA-01008: not all variables bound */ OCIFreeStatement($stmt);