note 118714 added to pdostatement.execute

"You cannot bind more values than specified; if more keys exist in input_parameters than in the SQL specified in the PDO::prepare(), then the statement will fail and an error is emitted." However fewer keys may not cause an error. As long as the number of question marks in the query string variable matches the number of elements in the input_parameters, the query will be attempted. This happens even if there is extraneous information after the end of the query string. The semicolon indicates the end of the query string; the rest of the variable is treated as a comment by the SQL engine, but counted as part of the input_parameters by PHP. Have a look at these two query strings. The only difference is a typo in the second string, where a semicolon accidentally replaces a comma. This UPDATE query will run, will be applied to all rows, and will silently damage the table. <?php /** * Query is intended to UPDATE a subset of the rows based on the WHERE clause */ $sql = "UPDATE my_table SET fname = ?, lname = ? WHERE id = ?"; /** * Query UPDATEs all rows, ignoring everything after the semi-colon, including the WHERE clause! * * Expected (but not received): * *** Warning: *** PDOStatement::execute(): *** SQLSTATE[HY093]: *** Invalid parameter number: number of bound variables does not match number of tokens... * */ // Typo here ------------------------ | // V $sql = "UPDATE my_table SET fname = ?; lname = ? WHERE id = ?"; // One token in effect $pdos = $pdo->prepare($sql); $pdos->execute( [ 'foo', 'bar', 3 ] ); // Three input_parameters ?> PHP 5.4.45, mysqlnd 5.0.10 ---- Server IP: 72.52.91.14 Probable Submitter: 98.169.66.145 ---- Manual Page -- http://php.net/manual/en/pdostatement.execute.php Edit -- https://master.php.net/note/edit/118714 Del: integrated -- https://master.php.net/note/delete/118714/integrated Del: useless -- https://master.php.net/note/delete/118714/useless Del: bad code -- https://master.php.net/note/delete/118714/bad+code Del: spam -- https://master.php.net/note/delete/118714/spam Del: non-english -- https://master.php.net/note/delete/118714/non-english Del: in docs -- https://master.php.net/note/delete/118714/in+docs Del: other reasons-- https://master.php.net/note/delete/118714 Reject -- https://master.php.net/note/reject/118714 Search -- https://master.php.net/manage/user-notes.php