Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78907
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain acquia.com designates 64.18.2.155 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH0thKBjR-6g0yrDtSORO9PszDnoMUJ2v5wUBxMh8iDdVYQ=Sw@mail.gmail.com>
References: <CAH0thKDOOV0DT5=DJRmoePXOtJhzJtwteTEW_iNA+5Q-gNXdxg@mail.gmail.com>
	<1415638978.23992.4.camel@kuechenschabe>
	<CAH0thKBjR-6g0yrDtSORO9PszDnoMUJ2v5wUBxMh8iDdVYQ=Sw@mail.gmail.com>
Date: Fri, 14 Nov 2014 10:04:50 -0500
Message-ID: <CAH0thKBHf1=XiHs20_1az2uaJ1=0AnWpC7unvAKYL1EK4shx3w@mail.gmail.com>
To: =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=90e6ba61389a5168090507d2f332
Subject: Re: [PHP-DEV] PDO mysql - add feature to enforce single statements?
From: peter.wolanin@acquia.com (Peter Wolanin)

--90e6ba61389a5168090507d2f332
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Added as a feature request also:  https://bugs.php.net/bug.php?id=3D68424

I'm a little unclear about the preferred workflow for using pull requests
vs. bugs.php.net - it seems liek most everything released ends up referring
to an issue on bugs.php.net?

-Peter

On Thu, Nov 13, 2014 at 8:21 PM, Peter Wolanin <peter.wolanin@acquia.com>
wrote:

> I've added a pull request here with a proposal to add the attribute at
> connection time: https://github.com/php/php-src/pull/896
>
> I think given PHP users the option to do this is really critical for
> securing against SQL injection, and giving more consistent behavior betwe=
en
> native and emulated prepares.
>
> From my reading of the mysql API, enabling multi-query implicitly enables
> multi results, but it's also possible to enable multi results separately,
> and I've left it as is, explicitly enabled, in the patch.
>
> Do you have an example of a stored procedure to test?
>
> Thanks,
>
> Peter
>
> On Mon, Nov 10, 2014 at 12:02 PM, Johannes Schl=C3=BCter <
> johannes@schlueters.de> wrote:
>
>> On Thu, 2014-11-06 at 19:52 -0500, Peter Wolanin wrote:
>> > Suggested solution: add a PDO attribute that could be set on a
>> > connection or a driver option for PDO::prepare to enforce the limit of
>> > a single query being prepared or run.
>>
>> The issue is that disabling multi-query implicitly also disables support
>> for stored procedures as the same flag configures handling of operations
>> with multiple result sets. So this probably needs more thoughts
>> especially in order to get "similar" behavior with different
>> databases ... can you add a feature request in the bug tracker for this?
>>
>> johannes
>>
>>
>>
>
>
> --
> Peter M. Wolanin, Ph.D.      : Momentum Specialist,  Acquia. Inc.
> peter.wolanin@acquia.com : 781-313-8322
>



--=20
Peter M. Wolanin, Ph.D.      : Momentum Specialist,  Acquia. Inc.
peter.wolanin@acquia.com : 781-313-8322

--90e6ba61389a5168090507d2f332--