Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115460
To: Jordan LeDoux <jordan.ledoux@gmail.com>,
 Craig Francis <craig@craigfrancis.co.uk>
Cc: Marco Pivetta <ocramius@gmail.com>,
 PHP internals <internals@lists.php.net>
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CADyq6s+eu4bLM3Z+28Vd0BoGzdbXRyG2Hw9OXqQtyok32p1CJQ@mail.gmail.com>
 <CAFv4g+H2Eec0SXif3=0nP4wwEaXzggTEPxJjm7fmuwQCR3CFFw@mail.gmail.com>
 <CAMrTa2GVpugjj71tcQO8oJgMyf7A_naHbrakjRWj92oKkAJQOw@mail.gmail.com>
Message-ID: <fc75a9e5-8f16-2fa1-01a0-a69fa7ed28ee@allenjb.me.uk>
Date: Sun, 18 Jul 2021 08:47:29 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.12.0
MIME-Version: 1.0
In-Reply-To: <CAMrTa2GVpugjj71tcQO8oJgMyf7A_naHbrakjRWj92oKkAJQOw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: php.lists@allenjb.me.uk (AllenJB)


On 18/07/2021 03:41, Jordan LeDoux wrote:
> Related to the general topic of injection attacks, I was considering
> submitting a PR to change the default of PDO::ATTR_EMULUATE_PREPARES to
> FALSE, since this mistakenly can lead people to believe that using prepared
> statements with PDO and MySQL protects against injection attacks. In fact,
> this is only the case if they create the PDO object with the option
> specified as false. I'm not aware however to reasoning for enabling prepare
> emulation by default for MySQL. I would assume it's a performance choice,
> but how long ago was this choice made and is it worth revisiting? Would
> this be something that requires its own RFC? It's a single line change.
>
> Jordan

There's some BC-breaks to be aware of when switching emulated prepares. 
One example I know of is that when using emulated prepares you can reuse 
the same placeholder (as in the following example), but with emulated 
prepares disabled this does not work.

$sql = "SELECT * FROM table WHERE column1 LIKE CONCAT('%', :searchValue, 
'%') OR column2 LIKE CONCAT('%', :searchValue, '%');";
$params = [
     "searchValue" => "test",
];

With emulated prepares disabled you have to use:

$sql = "SELECT * FROM table WHERE column1 LIKE CONCAT('%', :searchValue, 
'%') OR column2 LIKE CONCAT('%', :searchValue2, '%');";
$params = [
     "searchValue" => "test",
     "searchValue2" => "test",
];