Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113306
To: internals@lists.php.net
References: <499c2591-fb11-1b9d-d402-39f7ec1c6b85@themad.com.au>
 <6EC89E9A-035D-4D2B-97D7-845DC4FF3E32@koalephant.com>
 <CA+p1FaYJbD5Yyximj5LDdZmeCaxV_p1wnqyb9mfe=Bz9E-LVoA@mail.gmail.com>
 <e6a89e88-bbb3-91b7-e138-66719ba1f8c4@processus.org>
 <347e565f-f90a-5fc6-efcf-e28856ad00dc@gmail.com>
 <23cf71d2-4fed-ceab-6c63-c826af01bb36@processus.org>
Message-ID: <06b75517-ecdd-c409-e6ca-3a7ed14fb628@gmail.com>
Date: Sat, 27 Feb 2021 16:29:42 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.0
MIME-Version: 1.0
In-Reply-To: <23cf71d2-4fed-ceab-6c63-c826af01bb36@processus.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] PDO integer changes in 8.1 will stop many websites I
 support
From: rowan.collins@gmail.com (Rowan Tommins)

On 27/02/2021 15:51, Pierre wrote:
> Yes, but PDOStatement::execute() explicitly documents that it can be 
> used only for prepared queries.


The same is true of bindParam and bindValue - the only way of using 
parameters is to first "prepare" a query. Whether that's a real prepare 
(on the database server) or an emulated prepare doesn't make any 
difference, as far as I know.


> I'm not sure it requires two round trips when you use prepare() along 
> with emulated prepare


indeed, that was my point: currently, the only way to avoid the extra 
round-trip is emulated prepares, which means you don't get the full 
security of parameterised queries.


> It's sad PDO doesn't have a pg_query_params() equivalent method, most 
> people would stop using prepare() if that was the case. 


Agreed. :)

Although it would also require people to stop using the term "prepared 
query" to mean "parameterised query", which I see a lot.


Regards,

-- 
Rowan Tommins
[IMSoP]