Doc #68254 [Asn->Opn]: PDO lacks design implication discussion
[email protected] Tue, 20 Jun 2023 16:01:43 +0000
| Newsgroups | php.doc.bugs |
|---|---|
| Message-ID | <[email protected]> |
Edit report at https://bugs.php.net/bug.php?id=68254&edit=1 ID: 68254 Updated by: [email protected] Reported by: [email protected] Summary: PDO lacks design implication discussion -Status: Assigned +Status: Open Type: Documentation Problem Package: PDO related PHP Version: Irrelevant -Assigned To: tiffany +Assigned To: Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2014-10-17 15:01:10] [email protected] Description: ------------ It seems there is confusion around the PDO documentation with regards to "security" (see below internals ML posting). The PDO general documentation about prepared statements at http://php.net/manual/en/pdo.prepared-statements.php likes to highlight advantages of prepared statements and the bind API offered by PDO. Neither are PS disadvantages discussed nor is there any hint about implications of the PDO design (when PS emulation happens). This bares the risk of giving a false feeling of security. From - Fri Oct 17 15:12:46 2014 X-Account-Key: account6 X-UIDL: 0001de075098db15 X-Mozilla-Status: 0011 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] X-policyd-weight: using cached result; rate:hard: -6.1 Received: from lists.php.net (pb1.pair.com [76.75.200.58]) by dd5506.kasserver.com (Postfix) with ESMTP id 3D4443121D46 for <[email protected]>; Fri, 17 Oct 2014 15:09:14 +0200 (CEST) X-Host-Fingerprint: 76.75.200.58 pb1.pair.com Received: from [76.75.200.58] ([76.75.200.58:13395] helo=lists.php.net) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 99/F6-30834-7F411445 for <[email protected]>; Fri, 17 Oct 2014 09:09:12 -0400 Received: (qmail 34839 invoked by uid 1010); 17 Oct 2014 13:09:08 -0000 Mailing-List: contact [email protected]; run by ezmlm Precedence: bulk list-help: <mailto:[email protected]> list-unsubscribe: <mailto:[email protected]> list-post: <mailto:[email protected]> List-Id: internals.lists.php.net Delivered-To: mailing list [email protected] Received: (qmail 34831 invoked from network); 17 Oct 2014 13:09:08 -0000 Authentication-Results: pb1.pair.com [email protected]; spf=permerror; sender-id=unknown Authentication-Results: pb1.pair.com [email protected]; sender-id=unknown Received-SPF: error (pb1.pair.com: domain lsces.co.uk from 217.147.176.214 cause and error) X-PHP-List-Original-Sender: [email protected] X-Host-Fingerprint: 217.147.176.214 mail4-2.serversure.net Linux 2.6 Message-ID: <[email protected]> Date: Fri, 17 Oct 2014 14:09:03 +0100 From: Lester Caine <[email protected]> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.0 MIME-Version: 1.0 To: [email protected] References: <CAAyV7nFciZcsL+AW9W4GbhM+PhM3RhWOJ7G0iBQsEHfSWO2QmA@mail.gmail.com> <CAH-PCH6jVcXNtyySeY4EJZt2sQqhXFV=acO_x3HJb2f7WKtMPQ@mail.gmail.com> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> In-Reply-To: <[email protected]> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] [PATCH - PR] Disable ATTR_EMULATE_PREPARES by default for PDO_Mysql X-KasLoop: m026cece On 17/10/14 13:20, Ulf Wendel wrote: >> users know what they are getting and where the real security holes are. > Hmm, maybe, you could make this world a better one by contributing to > improve http://php.net/manual/en/pdo.prepared-statements.php ? PDO does not support management of SQL differences between databases. This page is a good example of where users run into problems because they have no idea if what they are copying actually works on their particular database. Does MySQL need ATTR_EMULATE_PREPARES in order to convert client side the SQL that it feeds over to the server? If I am converting from one database to another just what is actually supported and how? I don't use PDO with Firebird if I can help it but I am having to work with this where mysql hosting is the norm and PDO_mysql is an alternative that gets provided instead of mysqli. *I* have trouble sorting this stuff out so how do users who currently have working sites cope when things under the hood change perhaps without them even knowing. I can quite happily add notes as to what Firebird does with the various abstractions on that page, but what about every other PDO driver. Which emulate aspects of the prepares and which do it natively? Just what does get emulated? -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk Rainbow Digital Media - http://rainbowdigitalmedia.co.uk -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68254&edit=1