Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:52118
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type:content-transfer-encoding;
        b=OOAu8Upoq2s4Kyuqmu/bjbZS44RvJSsMnvRFMfW23wjbY7gtxKaJjMjBn7hREubCrW
         TF9baRver2Nxl60sSTeN+PjtAAb5OOfwEGPSMJ5lmLts9povEq/CQKkQKQn2HWPZyKl4
         roQVBstUbCSO8SOvYpG0ewW2Qok7pkiqtok0g=
MIME-Version: 1.0
In-Reply-To: <4DBC5C8B.8090404@lerdorf.com>
References: <BANLkTimtRdY_+Jj46jFEqkseuz7WD1ZPZQ@mail.gmail.com>
	<4DBC2D1B.10302@lerdorf.com>
	<4DBC4885.7010209@sugarcrm.com>
	<4DBC4C9A.2050502@lerdorf.com>
	<BANLkTikfWW=gczOf3a2c2wQ=bqSJBZH0qg@mail.gmail.com>
	<4DBC56D2.8060101@lerdorf.com>
	<BANLkTinpjwp4_DrRutaQo_=WwMDAnb2BbQ@mail.gmail.com>
	<4DBC5C8B.8090404@lerdorf.com>
Date: Sat, 30 Apr 2011 15:05:38 -0400
Message-ID: <BANLkTi=N7+gb29grnx6yFQX5vL-DQhiHHg@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Change Request: Make PDO default to not emulate
 prepared statements for MySQL
From: ircmaxell@gmail.com (Anthony Ferrara)

Native prepared statements will completely protect you from injection
via any of the bound parameters.  The wire-level passage of the data
is completely different (and the data is sent by length, rather than
by deliminator).  As an exercise, view the traffic that's sent to the
server via Wireshark...  As such, they are not subject to proper
escaping by character set.

On Sat, Apr 30, 2011 at 3:01 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
> On 04/30/2011 11:59 AM, Anthony Ferrara wrote:
>>
>> I'm not arguing if there weren't reasons for implementing it this way.
>> =A0I am arguing if they are good enough reasons to justify the security
>> impact. =A0It's not my decision (and I respect that), but I would stress
>> that what PDO is doing is not prepared statements or even
>> parameterized queries, and as such does not have the same benefits of
>> using true prepared statements (and perhaps the documentation needs to
>> be updated to reflect that).
>
> How is native prepared statements any more secure than emulated ones?
> Neither will completely protect you against SQLi.
>
> -Rasmus
>