Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78897
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain acquia.com designates 64.18.2.167 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <1415638978.23992.4.camel@kuechenschabe>
References: <CAH0thKDOOV0DT5=DJRmoePXOtJhzJtwteTEW_iNA+5Q-gNXdxg@mail.gmail.com>
	<1415638978.23992.4.camel@kuechenschabe>
Date: Thu, 13 Nov 2014 20:21:59 -0500
Message-ID: <CAH0thKBjR-6g0yrDtSORO9PszDnoMUJ2v5wUBxMh8iDdVYQ=Sw@mail.gmail.com>
To: =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=20cf300e53299f477b0507c7749d
Subject: Re: [PHP-DEV] PDO mysql - add feature to enforce single statements?
From: peter.wolanin@acquia.com (Peter Wolanin)

--20cf300e53299f477b0507c7749d
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I've added a pull request here with a proposal to add the attribute at
connection time: https://github.com/php/php-src/pull/896

I think given PHP users the option to do this is really critical for
securing against SQL injection, and giving more consistent behavior between
native and emulated prepares.

From my reading of the mysql API, enabling multi-query implicitly enables
multi results, but it's also possible to enable multi results separately,
and I've left it as is, explicitly enabled, in the patch.

Do you have an example of a stored procedure to test?

Thanks,

Peter

On Mon, Nov 10, 2014 at 12:02 PM, Johannes Schl=C3=BCter <johannes@schluete=
rs.de>
wrote:

> On Thu, 2014-11-06 at 19:52 -0500, Peter Wolanin wrote:
> > Suggested solution: add a PDO attribute that could be set on a
> > connection or a driver option for PDO::prepare to enforce the limit of
> > a single query being prepared or run.
>
> The issue is that disabling multi-query implicitly also disables support
> for stored procedures as the same flag configures handling of operations
> with multiple result sets. So this probably needs more thoughts
> especially in order to get "similar" behavior with different
> databases ... can you add a feature request in the bug tracker for this?
>
> johannes
>
>
>


--=20
Peter M. Wolanin, Ph.D.      : Momentum Specialist,  Acquia. Inc.
peter.wolanin@acquia.com : 781-313-8322

--20cf300e53299f477b0507c7749d--