php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #76647 PDO's query parser should warn with multiple named parameters
Submitted: 2018-07-19 15:11 UTC Modified: -
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: requinix@php.net Assigned:
Status: Open Package: PDO Core
PHP Version: 7.3.0alpha4 OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
29 - 22 = ?
Subscribe to this entry?

 
 [2018-07-19 15:11 UTC] requinix@php.net
Description:
------------
From bug #76639.

If PDO is not emulating prepares and a query contains named parameters,
  SELECT a FROM b WHERE c = :param OR d = :param

it will get rewritten to use placeholders
  SELECT a FROM b WHERE c = ? OR d = ?

When the user executes the query they will only provide one value, and that results in an error because the query requires two values. MySQL/pdo_mysql gives "SQLSTATE[HY093]: Invalid parameter number", which is technically correct but only understandable if the user knows about the rewriting. It also happens during the call to execute(), which is misleading as the problem was actually in the prepared statement given to prepare().

The docs for PDO::prepare() do speak of this:
> You cannot use a named parameter marker of the same name more than once in a prepared statement, unless
> emulation mode is on.

The request: Since PDO is parsing and rewriting queries during prepare(), it can recognize this situation happening and so should present a meaningful error message/exception at that time.

Test script:
---------------
<?php

$pdo = new PDO(...);
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

$pdo->prepare("SELECT :param, :param");

?>

Expected result:
----------------
Some appropriate error message or PDOException during $pdo->prepare().

Actual result:
--------------
Query is accepted and prepared even though it can't be executed.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Wed Apr 14 04:01:24 2021 UTC