Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115470
MIME-Version: 1.0
References: <CAFv4g+HRHrvCOTgpbVfCXj06De1kL+1+RwnGgq6tcyLNAtLfQA@mail.gmail.com>
 <CADyq6s+eu4bLM3Z+28Vd0BoGzdbXRyG2Hw9OXqQtyok32p1CJQ@mail.gmail.com>
 <CAFv4g+H2Eec0SXif3=0nP4wwEaXzggTEPxJjm7fmuwQCR3CFFw@mail.gmail.com>
 <CAMrTa2GVpugjj71tcQO8oJgMyf7A_naHbrakjRWj92oKkAJQOw@mail.gmail.com>
 <fc75a9e5-8f16-2fa1-01a0-a69fa7ed28ee@allenjb.me.uk> <CAG9XoMQ9KVR+4cOyg5ysiYZw0fxSu2FG4QFTgZ7L_aLMbkFBQA@mail.gmail.com>
 <CAMrTa2H53AbowERZBhfbWBGkbKcBJ4jFjhtcRXyybEcpYcVctA@mail.gmail.com>
In-Reply-To: <CAMrTa2H53AbowERZBhfbWBGkbKcBJ4jFjhtcRXyybEcpYcVctA@mail.gmail.com>
Date: Mon, 19 Jul 2021 11:04:50 +0700
Message-ID: <CAEZPtU6koz69jh+J+aiSuXBys1d2fHN_+oissntEh1ETx10sYA@mail.gmail.com>
To: Jordan LeDoux <jordan.ledoux@gmail.com>
Cc: Benjamin Morel <benjamin.morel@gmail.com>, AllenJB <php.lists@allenjb.me.uk>, 
	Craig Francis <craig@craigfrancis.co.uk>, Marco Pivetta <ocramius@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] [RFC] [VOTE] is_literal
From: pierre.php@gmail.com (Pierre Joye)

Good morning,

On Mon, Jul 19, 2021 at 9:11 AM Jordan LeDoux <jordan.ledoux@gmail.com> wrote:
>
> > Are there documented SQL injection opportunities when using emulated
> prepares? I'm not aware of any.
>
> This was from my reading of the actual source, which of course may be
> flawed. It appeared that if emulated prepares were used the values were
> escaped and then passed as strings as part of the query, the same as if it
> had been concatenated and wrapped in real_escape_string. I hadn't gone too
> far in actually debugging it yet to find out how it behaved under different
> circumstances as I was still trying to figure out how "small" of a change
> this was from the perspective of internals.

I also don't think there is any left over possible SQL injection in
any of the core DB extensions (PDO or 'native'). It will indeed do not
prevent inserting invalid data but if there were any actual SQL
injection left, I am very confident we would have known it by now. :)

-- 
Pierre

@pierrejoye | http://www.libgd.org