PHP 4.0 Bug #6198: Connecting to Postgres backend

From: goran@cenis.org.yu Operating system: Linux PHP version: 4.0.1pl2 PHP Bug Type: PostgreSQL related Bug description: Connecting to Postgres backend Functions pg_connect() and pg_pconnect() always connect to the PostgreSQL database with the user ID of the httpd server process. There is no way to set the user ID from PHP script, although Postgres connection protocol allows setting of username and password. This raises some security issues, because granting of access rights for database objects can't be properly imposed (user that httpd runs as has to have all rights to all database objects which PHP script must access). In the libpq library there are two database connection functions: PQsetdb() and PQsetdbLogin() with prototypes as: PGconn *PQsetdbLogin(const char *pghost, const char *pgport, const char *pgoptions, const char *pgtty, const char *dbName, const char *login, const char *pwd) PGconn *PQsetdb(char *pghost, char *pgport, char *pgoptions, char *pgtty, char *dbName) The Postgres programming manual states that PQsetdb() is only a macro that calls PQsetdbLogin() with null pointers for the login and pwd parameters, and that it is provided primarily for backward compatibility with old programs!!! I looked up pgsql.c module a little bit, and I noticed that it still uses old PQsetdb() function, which not only might soon be obsolete, but does not allow for user and password for database connection to be set programmatically. I think that this issue should be addressed as soon as possible. I would do it myself, but I'm not that comfortable with C/C++ programming.