php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #15673 Quotes crash MySQL queries: $array['val'] = Parse Error, but $array[val] works
Submitted: 2002-02-22 06:45 UTC Modified: 2002-02-22 13:48 UTC
From: jpaulomf at terra dot com dot br Assigned:
Status: Closed Package: Arrays related
PHP Version: 4.1.1 OS: Linux 2.4.5
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: jpaulomf at terra dot com dot br
New email:
PHP Version: OS:

 

 [2002-02-22 06:45 UTC] jpaulomf at terra dot com dot br
Here is the code:

error_reporting(E_ALL);
$table  =  array('admin'	    => 'md_adm'
		,'users'    => 'usuarios'
		,'tables'   => 'md_tables'
		,'product'  => 'md_prods'
		);

if(!connect_mydb()) die("unable to connect or select db");

if(isset($table['users'])) { // => works OK
echo "$table[users] will warn me!<br>"; // => warning
echo "$table['users']"; // => no warning
}

$query = "SELECT * from $table['users']";
$result = mysql_query($query); // => PARSE ERROR!!

//But if I delete the '' in $query it works ok:

$query = "SELECT * from $table[users]";
$result = mysql_query($query); // => Query done!!


According to PHP Manual in Arrays : "Why is $foo[bar] wrong?" the syntax $foo[bar] is deprecated despite working.

Jo?o Paulo M. Fischer

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-02-22 06:55 UTC] mfischer@php.net
Sounds very strange. Can you do a var_dump() on the sql string?

Can you also test and report back if it works with

  "SELECT * from {$table['users']}"

?
 [2002-02-22 06:59 UTC] jpaulomf at terra dot com dot br
d
 [2002-02-22 07:06 UTC] jpaulomf at terra dot com dot br
Sorry: The error occurs when we define the $query:

$query = "SELECT * from $table[users]"; // => This causes the parse error

echo "Table $table['users']" //=> Parse Error too
echo "Table".$table['users']; //=>OK
$query = "SELECT * from ".$table['users']; //=> OK TOO
 [2002-02-22 07:12 UTC] jpaulomf at terra dot com dot br
It seems we cannot use the correct syntax $table['users'] inside the two ""...

This will work:
$result = mysql_query("SELECT * from ".$table['users']);

This wont work:
$result = mysql_query("SELECT * from $table['users']");

This will, but should send a warning and it isnt:
$result = mysql_query("SELECT * from $table[users]");

The errors happens everywere I call any array with the '' or "" like $table["something"] or $table['something'] inside ""s...
 [2002-02-22 07:17 UTC] mfischer@php.net
Use the {$array['key']} syntax as I told you.

However, I can't remember if "foo $array['bar']" ever worked or not right now. Someone else?
 [2002-02-22 07:25 UTC] jpaulomf at terra dot com dot br
Hey man WOW, Im impressed, you have already replied!!!

Yes, this solution works:

$query = "SELECT * from {$table['users']}";

But shouldn't "Blah $table['users']" work as well?

Shouldn't PHP at least send a warning when using "$table[users]" even if the other "$arr['foo']" syntaxes where wrong?

Thanks!
 [2002-02-22 07:40 UTC] mfischer@php.net
Yes, I get you get a NOTICE warning when you use $array[key] (because key will be an undefined constant and therefore evaluate to a string).

Try with error_reporting(E_ALL); before using this syntax.
 [2002-02-22 07:52 UTC] jpaulomf at terra dot com dot br
I did this tests using error_reporting(E_ALL);

Thats my point, the correct array syntax according the doc:
http://www.php.net/manual/en/language.types.array.php
is to call $array['value'] even thought $array[value] will work, but in the later case it should send a NOTICE warning.

well, try this in you system:

error_reporting(E_ALL);
$arr = array( 'foo'  =>  'bar', 'etc' => 'other');

//This will make a Parse Error in PHP 4.1.1:
//echo "Foo value is $arr['foo']";
//This works:
echo "Foo value is ".$arr['foo'];
echo "Foo value is {$arr['foo']}";

//This will work but WON'T send a warning as the doc says:
echo "Foo value is $arr[foo]";
// This will get a parse error
echo "Foo value is $arr['foo']";
 [2002-02-22 08:12 UTC] mfischer@php.net
Work's right with CVS:

$ php 
<?
error_reporting(E_ALL);
$foo['key'] = 'value';
echo $foo[key];
?>
X-Powered-By: PHP/4.2.0-dev
Content-type: text/html

<br />
<b>Warning</b>:  Use of undefined constant key - assumed 'key' in <b>-</b> on line <b>4</b><br />
-(4) : Warning - Use of undefined constant key - assumed 'key'
 [2002-02-22 08:25 UTC] jpaulomf at terra dot com dot br
Yes, I know your code works, thats not the problem.

Now change your own code:

echo $foo[key];  ==to==> echo "Key value is $foo[key]"; // No warnings!!!!!

And then TRY:
echo "$foo['key']"; // PARSE ERROR!!!

Does it happens with the cvs version?
 [2002-02-22 08:29 UTC] mfischer@php.net
Ah, I see. No, there's no warning either.
 [2002-02-22 08:40 UTC] jpaulomf at terra dot com dot br
And the Parse Error, do you get it with the cvs ver too?
 [2002-02-22 09:42 UTC] hholzgra@php.net
i'll close this here and create a feature request
for "$array['index']" to be possible or for a better
error message at least ...

see http://bugs.php.net/15677

 [2002-02-22 10:02 UTC] jpaulomf at terra dot com dot br
Ok, but I think it should be seen as a BUG, since we cannot call the array as it should be and we are able to call it as it shouldn't.

PHP is expected work with codes like:
sql_query("SELECT * from $array['table']"); 

and its expected to (but doesnt have to) work with:
sql_query("SELECT * from $array[table]");
and in such case its expected to give a warning...

in both cases the behavior of 4.1.1 is buggy...

Thanks for your time people!
Best Regards

Jo?o Paulo M. Fischer
 [2002-02-22 10:31 UTC] hholzgra@php.net
> PHP is expected work with codes like:
> sql_query("SELECT * from $array['table']"); 

one *could* expect that it understood this,
that's what my feature request is about,
but "PHP is expected" is not right


> and its expected to (but doesnt have to) work with:
> sql_query("SELECT * from $array[table]");
> and in such case its expected to give a warning...

no, this is the current and expected behavior
no warning is generated here as no define() substitution
is done in strings

> in both cases the behavior of 4.1.1 is buggy...
it has been like this ever since 3.0, so you can't
call this 'buggy', call it 'unexpected  behaviour',
'inconsistent design' or whatever, but it is not
a bug ...



 [2002-02-22 11:44 UTC] jpaulomf at terra dot com dot br
> no warning is generated here as no define() substitution
> is done in strings
Why no define() is applied to the string??

From the PHP manual:
[quote]Why is $foo[bar] wrong?[/quote]
[quote]...there must be an expression between the square brackets ('[' and ']').[/quote]

Since there is no expression, the workaround IS to make a define() to the string or integer between the []s and set the value to its own name. 

error_reporting(E_ALL);
define("ke","key");

$foo['key'] = 'aaa';
$foo['ke'] = 'bbb';
echo "<br>It is<br>"
	."Foo[ke] ==> $foo[ke]";
echo "<br><br>It should be:<br>"
	."Foo[ke] ==> ".$foo[ke];

Ok, we can deal with this, but thats not the way it should work according with the good sense and the manual..

Regards
 [2002-02-22 13:48 UTC] philip@php.net
Constants are not looked for within strings, this is why "$foo[key]" does not generate a warning here.  But outside of strings this is a different story.

define ('a','b');
$arr = array('a' => 'apple', 'b' => 'banana');
print $arr['a'];    // apple
print $arr[a];      // banana
print "$arr[a]"     // apple
print "$arr['a']"   // parse error
print "{$arr['a']}" // apple

This bug report is a feature request for "$arr['a']" to print apple.  Regarding print $arr[a] above, if 'a' was not a defined constant, a warning would exist but apple is still printed (if key 'a' exists).
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun May 19 13:01:33 2024 UTC