Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:52116
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        b=JnhPyrwHbP9Kb8jmeRdIK6P8bgAIkcr2GJ/mIs2G57zn/bPzNN7ZEtGaJR9w5kE7an
         6nUB5YWajJaeMJzsP1+tXhH3IEAQgHA3pk1RRPLpGkje6n1CjJ1yPQtM6g1qPxjMlqPn
         pm/BpH4mp5KYAATHNQidliF75yUehu06AxUxI=
MIME-Version: 1.0
In-Reply-To: <4DBC56D2.8060101@lerdorf.com>
References: <BANLkTimtRdY_+Jj46jFEqkseuz7WD1ZPZQ@mail.gmail.com>
	<4DBC2D1B.10302@lerdorf.com>
	<4DBC4885.7010209@sugarcrm.com>
	<4DBC4C9A.2050502@lerdorf.com>
	<BANLkTikfWW=gczOf3a2c2wQ=bqSJBZH0qg@mail.gmail.com>
	<4DBC56D2.8060101@lerdorf.com>
Date: Sat, 30 Apr 2011 14:59:53 -0400
Message-ID: <BANLkTinpjwp4_DrRutaQo_=WwMDAnb2BbQ@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Ferenc Kovacs <info@tyrael.hu>, Stas Malyshev <smalyshev@sugarcrm.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Change Request: Make PDO default to not emulate
 prepared statements for MySQL
From: ircmaxell@gmail.com (Anthony Ferrara)

I'm not arguing if there weren't reasons for implementing it this way.
 I am arguing if they are good enough reasons to justify the security
impact.  It's not my decision (and I respect that), but I would stress
that what PDO is doing is not prepared statements or even
parameterized queries, and as such does not have the same benefits of
using true prepared statements (and perhaps the documentation needs to
be updated to reflect that).

Anthony

On Sat, Apr 30, 2011 at 2:37 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
> On 04/30/2011 11:10 AM, Ferenc Kovacs wrote:
>
>> with 5.0 EOL-ed for some time, and even the debian stable is running
>> 5.1, I wonder how many of our user runs 5.0.
>
> I'm not disagreeing, I just don't agree it is a bug against 5.3. There were
> good reasons for the default at the time 5.3 was released. For 5.4 it is
> probably time to switch it.
>
> -Rasmus
>