Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120719
MIME-Version: 1.0
References: <CA+kxMuTccYGT7fH+8u7N+iZtFzd3yZviu+1_+Afs01YvE5YvQg@mail.gmail.com>
 <20230629123944.35fc71a7@platypus>
In-Reply-To: <20230629123944.35fc71a7@platypus>
Date: Thu, 29 Jun 2023 18:08:00 +0100
Message-ID: <CA+kxMuQY-DZLHoYuzB8VbqZ+qtEonc5QHtp9xhHRWtM6K+mLwA@mail.gmail.com>
To: BohwaZ <php@bohwaz.net>
Cc: internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] PDO Subclasses coming to vote soon.
From: Danack@basereality.com (Dan Ackroyd)

On Thu, 29 Jun 2023 at 11:40, BohwaZ <php@bohwaz.net> wrote:
>
> I'm sorry to disagree, but changing this would be a bad idea for
> security.
>
> I'm quite sure that I never want users to be able to load any
> extension through SQL, or it would mean trouble :(
>
> So just like in the SQLite3 extension, extension loading should be
> limited to using the PHP method, not SQL.

Yes?

I think you possibly misread my email.

Danack wrote:
>
> As that means that SQLite extensions can only be loaded through C code
> (not through SQL),

aka the Sqlite people improved the api around extension loading since
it was implemented in the Sqlite3 extension
https://www.sqlite.org/c3ref/load_extension.html

So the only way to load an extension would be through the PHP
loadExtension method, it wouldn't be possible to load one through SQL.

> it would be great to also have

Sorry, I am in too much pain to look at those before the deadline.
There is always 8.4 https://www.youtube.com/watch?v=wccRif2DaGs .

cheers
Dan
Ack