|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #57661 Prepared Statement fails on multiple usage of ':value'
Submitted: 2007-05-10 05:59 UTC Modified: 2007-05-13 12:11 UTC
From: bhoehl at linotype dot com Assigned:
Status: Not a bug Package: PDO_MYSQL (PECL)
PHP Version: 5.1.4 OS: linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: bhoehl at linotype dot com
New email:
PHP Version: OS:


 [2007-05-10 05:59 UTC] bhoehl at linotype dot com
It is not possible to use a supplied value more than once for one prepared statement.
See error and code below.

Reproduce code:
create table a (key1 int) ;
create table b (key2 int) ;
insert into a values(1) ;
insert into b values(1) ;

$dbh = new PDO('mysql:host=somehost;dbname=somedb', 'user', 'password');

$res = $dbh->prepare('select * from a where key1 = :value union select * from b where key2 = :value') ;

$x = 1 ;
$res->bindParam(':value', $x) ;

$res->execute() ;
print_r($res->fetchAll()) ;

Expected result:
    [0] => Array
            [key1] => 1
            [0] => 1


Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2007-05-10 08:23 UTC]
That's expected behavior.
 [2007-05-10 09:21 UTC] bhoehl at linotype dot com
Please specify clearer, what it means, that this is expected.
That is an absolute normal sql statement and it makes
absolutely no sense in declaring another variable to do it.
 [2007-05-10 09:54 UTC] bhoehl at linotype dot com
BTW. I tried it with the postgres PDO driver using

$dbh = new PDO('pgsql:host=somehost;dbname=somedb', 'user', 'password');

and this stuff is working as expected.
Is that depending on the mysql server ?
 [2007-05-11 13:06 UTC] bhoehl at linotype dot com
I still expect an answer...
 [2007-05-13 10:48 UTC] bhoehl at linotype dot com
I did some more research and found out that the c api of mysql does not support named binding itself.
The proper named parameters have to be translated to position bound parameters.
Named parameters can appear more than once in prepared statements as postgresql shows.
The assumption that the count of supplied parameters is equal to the count of translated position bound parameters is wrong.
 [2007-05-13 12:11 UTC]
PDO doesn't support using the same named parameter multiple times because it is not portable and can lead to memory referencing issues and ultimately crash.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Wed Oct 04 12:01:25 2023 UTC