|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2020-11-12 16:17 UTC] sartorua at gmail dot com
Description:
------------
SQL statement parser don't work with prepared parameters if SQL query string contains \ and -- characters (order matters).
PHP produces error:
Exception 'PDOException' with message 'SQLSTATE[HY093]: Invalid parameter number: :e'
Test script:
---------------
$pdo = new \PDO('pgsql:host=localhost;dbname=postgres', 'postgres', 'postgres');
$s = $pdo->prepare("SELECT v FROM (VALUES ('\'),('--')) AS u (v) WHERE u.v = :e");
$s->execute([':e' => 'foo']);
$s->fetchAll();
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Sun Dec 22 05:01:30 2024 UTC |
New minimal test code: $pdo = new \PDO('pgsql:host=localhost;dbname=postgres', 'postgres', 'postgres'); $pdo->prepare("SELECT '\', '--' WHERE 'q' = :e")->execute([':e' => 'q']);