Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:29753
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pooteeweet.org from 212.112.227.169 cause and error)
Message-ID: <4656E0C8.6080801@pooteeweet.org>
Date: Fri, 25 May 2007 15:12:40 +0200
User-Agent: Thunderbird 2.0.0.0 (Windows/20070326)
MIME-Version: 1.0
To: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: PDO "bug" with LIMIT and emulate prepare
From: mls@pooteeweet.org (Lukas Kahwe Smith)

Hello,

A client alerted be to an issue caused by emulate prepare in combination 
with LIMIT clauses:
http://bugs.php.net/bug.php?id=40740

The problem is that any integer that should be inserted into a clause 
like "LIMIT ?, ?" would be quoted, which MySQL (same I would assume is 
the case with PostgreSQL, SQLite etc) obviously will not accept.

Here is the proposed solution:
Well there is no way to hint to MySQL if something is a string or not
using emulate_prepare. What I think could make sense is for MySQL to
look at the type though.

So that:

$foo = '1'; // quoted as a string
$foo = 1; // interpreted as an integer and therefore not quoted

This should be fine for security as well, since integers should not
cause any SQL injection issues.

Of course this would break any code where people try to insert an
integer into a string column. But I think this would be very rare and
the benefit would out weight the disadvantages.

However I would like to comment on a general issue here. This problem 
has been solved by many DBAL authors in the PHP space. While the may not 
be C hackers, they do know databases and the challenges in talking to 
them from PHP. Please all PDO developers leverage this experience. Feel 
free to talk to me .. or even better ask on 
phpdbabstraction@lists.pengus.net, which is where pretty much all of the 
main DBAL authors in the PHP world are reading. This way we can avoid 
doing some of the same issues that we have all gone through already.

regards,
Lukas