Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:52121
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:cc:content-type;
        b=ELFS8dnb6TJoYqLyCujpV1sACgFlhOUy7eQsbeWylYI4VP8CVK8KHOh+wQvd5wLnhN
         ISazU8alGWVWerJjXp2xR5O022UkdixWmIMDsHV6vZwZAfYZtb1NaxwIUb/iE9jLLTD0
         gLpOtBDqe8azrcztVQSCnhxjdCAwnIzsRbNcg=
MIME-Version: 1.0
Sender: tyra3l@gmail.com
In-Reply-To: <4DBC5C8B.8090404@lerdorf.com>
References: <BANLkTimtRdY_+Jj46jFEqkseuz7WD1ZPZQ@mail.gmail.com>
	<4DBC2D1B.10302@lerdorf.com>
	<4DBC4885.7010209@sugarcrm.com>
	<4DBC4C9A.2050502@lerdorf.com>
	<BANLkTikfWW=gczOf3a2c2wQ=bqSJBZH0qg@mail.gmail.com>
	<4DBC56D2.8060101@lerdorf.com>
	<BANLkTinpjwp4_DrRutaQo_=WwMDAnb2BbQ@mail.gmail.com>
	<4DBC5C8B.8090404@lerdorf.com>
Date: Sat, 30 Apr 2011 21:58:35 +0200
Message-ID: <BANLkTinF3sRVqOLdEkdKpcExBBmdEeDgkw@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Anthony Ferrara <ircmaxell@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=0016364163143a4bc904a228379c
Subject: Re: [PHP-DEV] Change Request: Make PDO default to not emulate
 prepared statements for MySQL
From: info@tyrael.hu (Ferenc Kovacs)

--0016364163143a4bc904a228379c
Content-Type: text/plain; charset=UTF-8

On Sat, Apr 30, 2011 at 9:01 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:

> On 04/30/2011 11:59 AM, Anthony Ferrara wrote:
>
>> I'm not arguing if there weren't reasons for implementing it this way.
>>  I am arguing if they are good enough reasons to justify the security
>> impact.  It's not my decision (and I respect that), but I would stress
>> that what PDO is doing is not prepared statements or even
>> parameterized queries, and as such does not have the same benefits of
>> using true prepared statements (and perhaps the documentation needs to
>> be updated to reflect that).
>>
>
> How is native prepared statements any more secure than emulated ones?
> Neither will completely protect you against SQLi.
>
> -Rasmus
>
>
real prepared statements push the parameter binding to the server, so you
have only one component where things could go wrong, with emulated prepared
statements you can be screwed both via the php parameter binding or when the
query is executed on the server (for example via the misunderstanding in the
encoding by the php lib and the mysql server)

Tyrael

--0016364163143a4bc904a228379c--