note 129734 added to pdo.pgsqlcopytofile

So I have been trying to use COPY (SELECT...) TO STDOUT WITH (FORMAT CSV, HEADER) but: - PDO::query() uses prepare, which COPY does not support - PDO::exec() does not return results - PDO::pgsqlCopyToFile() does not support additional parameters, only delimiter and nulls (and columns) But do you know what it does support? SQL Injections! https://github.com/php/php-src/blob/7dfbf4d1b74b5e629f2331261944fa072a92e1cb/ext/pdo_pgsql/pgsql_driver.c#L870 spprintf(&query, 0, "COPY %s TO STDIN WITH DELIMITER E'%c' NULL AS E'%s'", ... There is no escaping around any of that, so you can call this method like so: <?php $db->pgsqlCopyToFile("(select * from t1 cross join t2 using (whatever))", '/tmp/test.csv', ',', '\' header--'); ?> and that actually produces: COPY (select...) TO STDIN WITH DELIMITER E',' NULL AS E'' header-- It still uses local filesystem, which I can live with, but at least I don't have to dance around the CSV headers. If anyone knows of a better way to do this without copying the (in my case gigantic) resultset into array and fputcsv(), I'm all ears. And I've tried every combination with pg_query and pg_copy_to to no avail. ---- Server IP: 45.112.84.4 Probable Submitter: 80.90.5.137 (proxied: 2a02:ab04:230:3100:3660:f9ff:fe54:52ee) ---- Manual Page -- https://php.net/manual/en/pdo.pgsqlcopytofile.php Edit -- https://main.php.net/note/edit/129734 Del: integrated -- https://main.php.net/note/delete/129734/integrated Del: useless -- https://main.php.net/note/delete/129734/useless Del: bad code -- https://main.php.net/note/delete/129734/bad+code Del: spam -- https://main.php.net/note/delete/129734/spam Del: non-english -- https://main.php.net/note/delete/129734/non-english Del: in docs -- https://main.php.net/note/delete/129734/in+docs Del: other reasons-- https://main.php.net/note/delete/129734 Reject -- https://main.php.net/note/reject/129734 Search -- https://main.php.net/manage/user-notes.php