Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78128
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5440A046.8040501@lerdorf.com>
References: <CAAyV7nFciZcsL+AW9W4GbhM+PhM3RhWOJ7G0iBQsEHfSWO2QmA@mail.gmail.com>
	<CAH-PCH6jVcXNtyySeY4EJZt2sQqhXFV=acO_x3HJb2f7WKtMPQ@mail.gmail.com>
	<543FE883.2070401@lerdorf.com>
	<CAH-PCH65qUuZvzu6q6BF80O-peowgB2K9nAWDznEfgOTgcj7eg@mail.gmail.com>
	<5440A046.8040501@lerdorf.com>
Date: Fri, 17 Oct 2014 08:59:51 +0200
Message-ID: <CAH-PCH4mz4gFmH5h2M+KTAQ6uSaSQKm0781QS6i6CoZ5LUBFwA@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135e6fe565182050598e957
Subject: Re: [PHP-DEV] [PATCH - PR] Disable ATTR_EMULATE_PREPARES by default
 for PDO_Mysql
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a1135e6fe565182050598e957
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

2014.10.17. 6:51 ezt =C3=ADrta ("Rasmus Lerdorf" <rasmus@lerdorf.com>):
>
> On 10/16/2014 09:10 AM, Ferenc Kovacs wrote:
> > I don't think we should remove the option, just change the defaults, an=
d
> > most people would be fine switching back to the emulation, but it shoul=
d
> > be their conscious decision imo.
> > Currently many people aren't aware that they are using client side
> > prepares, and they are pretty much ignore the fact, that they can be
> > exposed to sql injections (for example via using mismatching client and
> > server encodings or not properly quoting the
> > identifiers: http://www.codeyellow.nl/identifier-sqli.html because they
> > think that server side prepared statements would be immune to this kind
> > of problems).
>
> I think you have the wrong idea here. That link you pointed to talks
> about SQLi in identifiers. Server-side prepares are just as vulnerable
> to this, so switching from client-side to server-side does nothing to
> make this safer.

Server side prepares does not support parameter binding for identifiers so
while you can still be vulnerable if you concatenate variables into your
query, but you wouldn't think that you are immune to sql injection that way=
.
Emulated prepares make it look like that you are.

>
> As far as a charset mismatch between the client and the server when it
> comes to preparing query values, PDO's implementation handles that. You
> need a connection handle to do a prepare so we know the charset and take
> that into account.

Same thing here, while (since 5.3.6 afair) you are able to pass the
encoding information to the pdo driver (before that you could only use set
names which pdo doesn't care about) the emulation still make it look like
that you are immune, because many people aren't aware of the emulation and
assumes that they are immune to sqli because the params travel as separate
entity from the query to the server.

--001a1135e6fe565182050598e957--