Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:52120
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.170 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type:content-transfer-encoding;
        b=dQjl23FYh47vII1QVDYyjHRAMW9QqO09A+1+a0BeOkKyZjtU38OUcLRgAPF4qR62V1
         gGKa6PbK7V7uhgiPwWQBpaydc1rD9AkNzUlySsgR3FTZzEj45Sgs0v8yNShU+U46BrNJ
         PNf0vmQ7+njWdg+6d+c52RcAv1whCfcETJlK0=
MIME-Version: 1.0
In-Reply-To: <4DBC5F00.3090309@lerdorf.com>
References: <BANLkTimtRdY_+Jj46jFEqkseuz7WD1ZPZQ@mail.gmail.com>
	<4DBC2D1B.10302@lerdorf.com>
	<4DBC4885.7010209@sugarcrm.com>
	<4DBC4C9A.2050502@lerdorf.com>
	<BANLkTikfWW=gczOf3a2c2wQ=bqSJBZH0qg@mail.gmail.com>
	<4DBC56D2.8060101@lerdorf.com>
	<BANLkTinpjwp4_DrRutaQo_=WwMDAnb2BbQ@mail.gmail.com>
	<4DBC5C8B.8090404@lerdorf.com>
	<BANLkTi=N7+gb29grnx6yFQX5vL-DQhiHHg@mail.gmail.com>
	<4DBC5F00.3090309@lerdorf.com>
Date: Sat, 30 Apr 2011 15:17:59 -0400
Message-ID: <BANLkTikWjwNS6j8B2T7V2wchzL159DRccw@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Change Request: Make PDO default to not emulate
 prepared statements for MySQL
From: ircmaxell@gmail.com (Anthony Ferrara)

Correct.  But prior to 5.3.6 it was not possible to have PDO and MySQL
agree on the character set (at least without having root access to the
server).  And after 5.3.6, the DSN *must* include the charset
parameter to make them agree.  The common technique of setting the
charset via SET NAMES (which most frameworks and libraries do) will
not work.  So instead you have people using prepared statements
thinking that they are safe (since all documentation says so) while
they are actually not.

My suggestion is to make them actually safe right from the source
rather than requiring an API change.  The best solution would be
education and raising awareness as well as fixing it in the core.  The
code is there to do so, all it takes is a single bit change in the
source...

Again, that's just my opinion...

Anthony

On Sat, Apr 30, 2011 at 3:12 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
> On 04/30/2011 12:05 PM, Anthony Ferrara wrote:
>>
>> Native prepared statements will completely protect you from injection
>> via any of the bound parameters. =A0The wire-level passage of the data
>> is completely different (and the data is sent by length, rather than
>> by deliminator). =A0As an exercise, view the traffic that's sent to the
>> server via Wireshark... =A0As such, they are not subject to proper
>> escaping by character set.
>
> As long as PDO and MySQL agree on which character set is in use bound
> parameters are safe in emulated prepares as well.
>
> -Rasmus
>