Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115466
MIME-Version: 1.0
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CADyq6s+eu4bLM3Z+28Vd0BoGzdbXRyG2Hw9OXqQtyok32p1CJQ@mail.gmail.com>
 <CAFv4g+H2Eec0SXif3=0nP4wwEaXzggTEPxJjm7fmuwQCR3CFFw@mail.gmail.com>
 <CAMrTa2GVpugjj71tcQO8oJgMyf7A_naHbrakjRWj92oKkAJQOw@mail.gmail.com> <fc75a9e5-8f16-2fa1-01a0-a69fa7ed28ee@allenjb.me.uk>
In-Reply-To: <fc75a9e5-8f16-2fa1-01a0-a69fa7ed28ee@allenjb.me.uk>
Date: Mon, 19 Jul 2021 00:37:49 +0200
Message-ID: <CAG9XoMQ9KVR+4cOyg5ysiYZw0fxSu2FG4QFTgZ7L_aLMbkFBQA@mail.gmail.com>
To: AllenJB <php.lists@allenjb.me.uk>
Cc: Jordan LeDoux <jordan.ledoux@gmail.com>, Craig Francis <craig@craigfrancis.co.uk>, 
	Marco Pivetta <ocramius@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000000ffac705c76d793d"
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: benjamin.morel@gmail.com (Benjamin Morel)

--0000000000000ffac705c76d793d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

>
> There's some BC-breaks to be aware of when switching emulated prepares.
> One example I know of is that when using emulated prepares you can reuse
> the same placeholder (as in the following example), but with emulated
> prepares disabled this does not work.
>
> $sql =3D "SELECT * FROM table WHERE column1 LIKE CONCAT('%', :searchValue=
,
> '%') OR column2 LIKE CONCAT('%', :searchValue, '%');";
> $params =3D [
>      "searchValue" =3D> "test",
> ];
>

This, and do note that from a performance point of view, disabling emulated
prepares is not innocuous : most of the time, you effectively send twice as
many queries to the database : one prepare, one execute.
There is a *small* performance improvement in using prepared statements if
you're executing the same statement many times; but in all other cases,
you're spending twice as much time waiting for the database.

Are there documented SQL injection opportunities when using emulated
prepares? I'm not aware of any.

=E2=80=94 Benjamin

--0000000000000ffac705c76d793d--