[PHP-BUG] Req #51428 [NEW]: new PDO is spitting out the password/username for all to see on error.

From:             
Operating system: 
PHP version:      5.2.13
Package:          PostgreSQL related
Bug Type:         Feature/Change Request
Bug description:new PDO is spitting out the password/username for all to see on error.

Description:
------------
Despite using the code as provided in the 'test script field', if the
creation of the PDO object fails it shows both the username and password.


Fatal error: Uncaught exception 'PDOException' with message 'could not find
driver' in C:\Program Files\BitNami WAPPStack\apache2\htdocs\cb.php:12
Stack trace: #0 C:\Program Files\BitNami
WAPPStack\apache2\htdocs\cb.php(12): PDO->__construct('pgsql:dbname=an...',
'someUsername', 'somePassword') #1 {main} thrown in C:\Program
Files\BitNami WAPPStack\apache2\htdocs\cb.php  on line 12

So the first 2 letters of the database are visible along with the complete
username and password. They hardly add anything of value to the error
itself but pose quite the security risk if you have error reporting enabled
on a production server.


Test script:
---------------
$settings = array(
  'database' => 'anAaa',
  'host'     => 'localhost',
  'username' => 'someUsername',
  'password' => 'somePassword'
);

$db = new PDO(
	  sprintf(
	    'pgsql:dbname=%s;host=%s',
	    $settings['database'],
	    $settings['host']
	  ),
	  $settings['username'],
	  $settings['password']
	);[/code]


-- 
Edit bug report at http://bugs.php.net/bug.php?id=51428&edit=1
-- 
Try a snapshot (PHP 5.2):            http://bugs.php.net/fix.php?id=51428&r=trysnapshot52
Try a snapshot (PHP 5.3):            http://bugs.php.net/fix.php?id=51428&r=trysnapshot53
Try a snapshot (PHP 6.0):            http://bugs.php.net/fix.php?id=51428&r=trysnapshot60
Fixed in SVN:                        http://bugs.php.net/fix.php?id=51428&r=fixed
Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=51428&r=needdocs
Fixed in release:                    http://bugs.php.net/fix.php?id=51428&r=alreadyfixed
Need backtrace:                      http://bugs.php.net/fix.php?id=51428&r=needtrace
Need Reproduce Script:               http://bugs.php.net/fix.php?id=51428&r=needscript
Try newer version:                   http://bugs.php.net/fix.php?id=51428&r=oldversion
Not developer issue:                 http://bugs.php.net/fix.php?id=51428&r=support
Expected behavior:                   http://bugs.php.net/fix.php?id=51428&r=notwrong
Not enough info:                     http://bugs.php.net/fix.php?id=51428&r=notenoughinfo
Submitted twice:                     http://bugs.php.net/fix.php?id=51428&r=submittedtwice
register_globals:                    http://bugs.php.net/fix.php?id=51428&r=globals
PHP 4 support discontinued:          http://bugs.php.net/fix.php?id=51428&r=php4
Daylight Savings:                    http://bugs.php.net/fix.php?id=51428&r=dst
IIS Stability:                       http://bugs.php.net/fix.php?id=51428&r=isapi
Install GNU Sed:                     http://bugs.php.net/fix.php?id=51428&r=gnused
Floating point limitations:          http://bugs.php.net/fix.php?id=51428&r=float
No Zend Extensions:                  http://bugs.php.net/fix.php?id=51428&r=nozend
MySQL Configuration Error:           http://bugs.php.net/fix.php?id=51428&r=mysqlcfg