|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2014-01-01 12:40 UTC] felipe@php.net
-Package: PDO related
+Package: PDO Core
[2016-08-08 17:43 UTC] cmb@php.net
-Status: Open
+Status: Feedback
-Assigned To:
+Assigned To: cmb
[2016-08-08 17:43 UTC] cmb@php.net
[2016-08-21 04:22 UTC] php-bugs at lists dot php dot net
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sat Dec 06 17:00:01 2025 UTC |
Description: ------------ The query INSERT INTO $table VALUES (\"first value\"); -- dam'd quote INSERT INTO $table VALUES (\"foo : ba'r \"), (\"foo.:bar\"); Throws Warning: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number: no parameters were bound But doesn't - without first query before comment - without comment - with escaped quote - with space after last colon Test script: --------------- // This query doesn't work $q1 = "INSERT INTO $table VALUES (\"first value\"); -- dam'd quote INSERT INTO $table VALUES (\"foo : ba'r \"), (\"foo.:bar\"); "; // But all these doesn't have any pb $q2 = "-- dam'd quote INSERT INTO $table VALUES (\"foo : ba'r \"), (\"foo.:bar\"); "; // without first one (before comment) $q3 = "INSERT INTO $table VALUES (\"first value\"); INSERT INTO $table VALUES (\"foo : ba'r \"), (\"foo.:bar\"); "; // without comment $q4 = "INSERT INTO $table VALUES (\"first value\"); -- dam'd quote INSERT INTO $table VALUES (\"foo : ba\'r \"), (\"foo.:bar\"); "; // with escaped quote $q5 = "INSERT INTO $table VALUES (\"first value\"); -- dam'd quote INSERT INTO $table VALUES (\"foo : ba'r \"), (\"foo.: bar\"); "; // with space after last colon try { $pdo = new PDO($dsn, $user, $pass, $options); $stmt = $pdo->prepare($query); $stmt->execute(); } catch (Exception $e) { echo "Failed : " .$e->getMessage(); } Expected result: ---------------- No warning Actual result: -------------- Warning: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number: no parameters were bound