php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #57661 Prepared Statement fails on multiple usage of ':value'
Submitted: 2007-05-10 05:59 UTC Modified: 2007-05-13 12:11 UTC
From: bhoehl at linotype dot com Assigned:
Status: Not a bug Package: PDO_MYSQL (PECL)
PHP Version: 5.1.4 OS: linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: bhoehl at linotype dot com
New email:
PHP Version: OS:

 

 [2007-05-10 05:59 UTC] bhoehl at linotype dot com 
Description:
------------
It is not possible to use a supplied value more than once for one prepared statement.
See error and code below.


Reproduce code:
---------------
create table a (key1 int) ;
create table b (key2 int) ;
insert into a values(1) ;
insert into b values(1) ;

<?php>
$dbh = new PDO('mysql:host=somehost;dbname=somedb', 'user', 'password');

$res = $dbh->prepare('select * from a where key1 = :value union select * from b where key2 = :value') ;

$x = 1 ;
$res->bindParam(':value', $x) ;

$res->execute() ;
print_r($res->fetchAll()) ;
?>


Expected result:
----------------
Array
(
    [0] => Array
        (
            [key1] => 1
            [0] => 1
        )

)


Actual result:
--------------
Array
(
)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-05-10 08:23 UTC] wez@php.net 
That's expected behavior.
 [2007-05-10 09:21 UTC] bhoehl at linotype dot com 
Please specify clearer, what it means, that this is expected.
That is an absolute normal sql statement and it makes
absolutely no sense in declaring another variable to do it.
 [2007-05-10 09:54 UTC] bhoehl at linotype dot com 
BTW. I tried it with the postgres PDO driver using

$dbh = new PDO('pgsql:host=somehost;dbname=somedb', 'user', 'password');

and this stuff is working as expected.
Is that depending on the mysql server ?
 [2007-05-11 13:06 UTC] bhoehl at linotype dot com 
I still expect an answer...
 [2007-05-13 10:48 UTC] bhoehl at linotype dot com 
I did some more research and found out that the c api of mysql does not support named binding itself.
The proper named parameters have to be translated to position bound parameters.
Named parameters can appear more than once in prepared statements as postgresql shows.
The assumption that the count of supplied parameters is equal to the count of translated position bound parameters is wrong.
 [2007-05-13 12:11 UTC] wez@php.net 
PDO doesn't support using the same named parameter multiple times because it is not portable and can lead to memory referencing issues and ultimately crash.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Nov 06 22:00:01 2025 UTC