Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113301
To: internals@lists.php.net
References: <499c2591-fb11-1b9d-d402-39f7ec1c6b85@themad.com.au>
 <6EC89E9A-035D-4D2B-97D7-845DC4FF3E32@koalephant.com>
 <CA+p1FaYJbD5Yyximj5LDdZmeCaxV_p1wnqyb9mfe=Bz9E-LVoA@mail.gmail.com>
 <e6a89e88-bbb3-91b7-e138-66719ba1f8c4@processus.org>
Message-ID: <347e565f-f90a-5fc6-efcf-e28856ad00dc@gmail.com>
Date: Sat, 27 Feb 2021 14:39:47 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.0
MIME-Version: 1.0
In-Reply-To: <e6a89e88-bbb3-91b7-e138-66719ba1f8c4@processus.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] PDO integer changes in 8.1 will stop many websites I
 support
From: rowan.collins@gmail.com (Rowan Tommins)

On 27/02/2021 14:03, Pierre wrote:
> I'm curious, why are you stating that emulated prepares are not useful 
> anymore ?


Emulated prepares are a slightly dangerous idea, because they give the 
impression of separating query from data, but actually use string 
escaping internally. Historically, I believe there were previously 
scenarios where real prepared queries were not available, which no 
longer apply.


> Using the prepare() function as I remember correctly seems to be the 
> only way to execute a query that allows you to pass an array of 
> parameters instead of having to call PDOStatement::bindParam() for 
> each parameter.


Regardless of whether you use emulated or real prepares, the 
PDOStatement's execute method can be called with an array of parameters, 
and as far as I know always could.


> That's the only reason I use emulated prepares anyway, it allows to 
> use this API without actually preparing the queries, which is what I 
> want most of the time.


This is a slightly different point: when running a query once, it seems 
to currently require two database round trips: one to prepare, and one 
to execute. I don't know what the underlying drivers support here, but 
it would be useful to have a method on the PDO object itself that let 
you provide a parameterised string and its data in one go. That would be 
safer than using emulated prepares, and (hopefully) more efficient than 
using real prepares.

Regards,

-- 
Rowan Tommins
[IMSoP]