Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78946
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain acquia.com designates 64.18.2.163 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH70P2ZktJ0QPFycSB7X=9TFBQ9LBC3yZhrCnjwHuDczpA@mail.gmail.com>
References: <CAH0thKDOOV0DT5=DJRmoePXOtJhzJtwteTEW_iNA+5Q-gNXdxg@mail.gmail.com>
	<1415638978.23992.4.camel@kuechenschabe>
	<CAH0thKBjR-6g0yrDtSORO9PszDnoMUJ2v5wUBxMh8iDdVYQ=Sw@mail.gmail.com>
	<CAH0thKBHf1=XiHs20_1az2uaJ1=0AnWpC7unvAKYL1EK4shx3w@mail.gmail.com>
	<CAH-PCH70P2ZktJ0QPFycSB7X=9TFBQ9LBC3yZhrCnjwHuDczpA@mail.gmail.com>
Date: Tue, 18 Nov 2014 11:00:49 -0500
Message-ID: <CAH0thKAJ4FGwua9mP96dgmNx9qW_WSkb8hfBfQuSzyFFE77fBQ@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary=001a1140f88eeff1de050824321b
Subject: Re: [PHP-DEV] PDO mysql - add feature to enforce single statements?
From: peter.wolanin@acquia.com (Peter Wolanin)

--001a1140f88eeff1de050824321b
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Any other input on this pull request?  Are there tests that should be
duplicated to run in single vs multi query mode?

-Peter

On Fri, Nov 14, 2014 at 10:49 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote:

> yeah, the consensus was to create feature request on bugs.php.net for PRs
> (and link the PR from the bugtracker), so that we each NEWS entry can lin=
k
> to a bug#.
>
> On Fri, Nov 14, 2014 at 4:04 PM, Peter Wolanin <peter.wolanin@acquia.com>
> wrote:
>
>> Added as a feature request also:  https://bugs.php.net/bug.php?id=3D6842=
4
>>
>> I'm a little unclear about the preferred workflow for using pull request=
s
>> vs. bugs.php.net - it seems liek most everything released ends up
>> referring
>> to an issue on bugs.php.net?
>>
>> -Peter
>>
>> On Thu, Nov 13, 2014 at 8:21 PM, Peter Wolanin <peter.wolanin@acquia.com=
>
>> wrote:
>>
>> > I've added a pull request here with a proposal to add the attribute at
>> > connection time: https://github.com/php/php-src/pull/896
>> >
>> > I think given PHP users the option to do this is really critical for
>> > securing against SQL injection, and giving more consistent behavior
>> between
>> > native and emulated prepares.
>> >
>> > From my reading of the mysql API, enabling multi-query implicitly
>> enables
>> > multi results, but it's also possible to enable multi results
>> separately,
>> > and I've left it as is, explicitly enabled, in the patch.
>> >
>> > Do you have an example of a stored procedure to test?
>> >
>> > Thanks,
>> >
>> > Peter
>> >
>> > On Mon, Nov 10, 2014 at 12:02 PM, Johannes Schl=C3=BCter <
>> > johannes@schlueters.de> wrote:
>> >
>> >> On Thu, 2014-11-06 at 19:52 -0500, Peter Wolanin wrote:
>> >> > Suggested solution: add a PDO attribute that could be set on a
>> >> > connection or a driver option for PDO::prepare to enforce the limit
>> of
>> >> > a single query being prepared or run.
>> >>
>> >> The issue is that disabling multi-query implicitly also disables
>> support
>> >> for stored procedures as the same flag configures handling of
>> operations
>> >> with multiple result sets. So this probably needs more thoughts
>> >> especially in order to get "similar" behavior with different
>> >> databases ... can you add a feature request in the bug tracker for
>> this?
>> >>
>> >> johannes
>> >>
>> >>
>> >>
>> >
>> >
>> > --
>> > Peter M. Wolanin, Ph.D.      : Momentum Specialist,  Acquia. Inc.
>> > peter.wolanin@acquia.com : 781-313-8322
>> >
>>
>>
>>
>> --
>> Peter M. Wolanin, Ph.D.      : Momentum Specialist,  Acquia. Inc.
>> peter.wolanin@acquia.com : 781-313-8322
>>
>
>
>
> --
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu
>



--=20
Peter M. Wolanin, Ph.D.      : Momentum Specialist,  Acquia. Inc.
peter.wolanin@acquia.com : 781-313-8322

--001a1140f88eeff1de050824321b--