# PDO "bug" with LIMIT and emulate prepare

- Thread: https://externals.io/message/29753
- Original archive: https://news-web.php.net/php.internals/29753
- Started by Lukas Kahwe Smith on 2007-05-25T13:12:40+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #29753 — Lukas Kahwe Smith — 2007-05-25T13:12:40+00:00

URL: https://externals.io/message/29753#29753

Hello,

A client alerted be to an issue caused by emulate prepare in combination 
with LIMIT clauses:
http://bugs.php.net/bug.php?id=40740

The problem is that any integer that should be inserted into a clause 
like "LIMIT ?, ?" would be quoted, which MySQL (same I would assume is 
the case with PostgreSQL, SQLite etc) obviously will not accept.

Here is the proposed solution:
Well there is no way to hint to MySQL if something is a string or not
using emulate_prepare. What I think could make sense is for MySQL to
look at the type though.

So that:

$foo = '1'; // quoted as a string
$foo = 1; // interpreted as an integer and therefore not quoted

This should be fine for security as well, since integers should not
cause any SQL injection issues.

Of course this would break any code where people try to insert an
integer into a string column. But I think this would be very rare and
the benefit would out weight the disadvantages.

However I would like to comment on a general issue here. This problem 
has been solved by many DBAL authors in the PHP space. While the may not 
be C hackers, they do know databases and the challenges in talking to 
them from PHP. Please all PDO developers leverage this experience. Feel 
free to talk to me .. or even better ask on 
phpdbabstraction@lists.pengus.net, which is where pretty much all of the 
main DBAL authors in the PHP world are reading. This way we can avoid 
doing some of the same issues that we have all gone through already.

regards,
Lukas