|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2007-04-17 20:34 UTC] ed at bronto dot com
Description:
------------
Using PDO->quote on a portion of a query to be prepared will result in a seg fault if:
- there is a bound parameter after the quoted value
- emulated prepares is on (1)
- mysql
If emulated prepares is off (0), the query fails. This should also be considered a bug.
Reproduce code:
---------------
//test.php
//the mysql table first: create table ed (id int not null, name varchar(255) not null);
$db = new PDO('mysql:host=' . HOST . ';dbname=' . NAME, USERNAME, PASSWORD);
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 1);
$search = "o'riley";
$values = array();
$sql = "select id from ed where name like " . $db->quote('%' . $search . '%');
$sth = $db->prepare($sql);
$sth->execute($values);
echo("here\n");
$values = array('id' => 1233434);
$sql = "select id from ed where name like " . $db->quote('%' . $search . '%') . " and id = :id";
$sth = $db->prepare($sql);
$sth->execute($values);
echo("there\n");
Expected result:
----------------
No errors should occur.
Should print "here\nthere\n".
Actual result:
--------------
[ed@a_machine]$ php test.php
here
Segmentation fault
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 22:00:01 2025 UTC |
This bug still exists in PHP 5_3. Its as simple as this to crash PDO: $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 1); $db->query("SELECT 1 FROM DUAL WHERE 'test' LIKE '\'' AND 0 > :id"); ==20117== Invalid read of size 1 ==20117== at 0x4A21EF8: memcpy (mc_replace_strmem.c:402) ==20117== by 0x4E3475: pdo_parse_params (pdo_sql_parser.re:291) ==20117== by 0x4DB205: zim_PDOStatement_execute (pdo_stmt.c:482) ==20117== by 0x7858AD: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:313) ==20117== by 0x786638: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:422) ==20117== by 0x784AF9: execute (zend_vm_execute.h:104) ==20117== by 0x758DF9: zend_execute_scripts (zend.c:1198) ==20117== by 0x6E5D5E: php_execute_script (main.c:2082) ==20117== by 0x7F6986: main (php_cli.c:1139)Grr, I need a break - same pattern but should not cause any parse errors etc. $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 1); $sql = "SELECT 1, 2 FROM DUAL WHERE 'test' LIKE 'O\'chaos' AND :id"; $stmt = $db->prepare($sql); $id = 0; $stmt->bindParam(':id', $id); $stmt->execute();