Bad interactions with PostgreSQL query munging and embedded values #175

Closed
opened 5 years ago by jking · 0 comments
jking commented 5 years ago
Owner

Natively PostgreSQL uses e.g. $1 as a parameter marker instead of ?. PDO handles this conversion, but for the native driver we've had to change the markers ourselves.

When this was originally implemented it was assumed all values would be placed in parameters and thus any ? characters would be parameter markers and a simple string replacement could be used. Since then, strings are sometimes embedded to ease pressure on the limited number of parameter markers themselves; strings literals containing ? might therefore now appear in queries, breaking things spectacularly.

Indeed, this part of query construction is poorly tested, so more tests are required. The simplest solution is probably to never embed any string which contains a question mark.

Natively PostgreSQL uses e.g. `$1` as a parameter marker instead of `?`. PDO handles this conversion, but for the native driver we've had to change the markers ourselves. When this was originally implemented it was assumed all values would be placed in parameters and thus any `?` characters would be parameter markers and a simple string replacement could be used. Since then, strings are sometimes embedded to ease pressure on the limited number of parameter markers themselves; strings literals containing `?` might therefore now appear in queries, breaking things spectacularly. Indeed, this part of query construction is poorly tested, so more tests are required. The simplest solution is probably to never embed any string which contains a question mark.
jking added this to the Future milestone 5 years ago
jking self-assigned this 5 years ago
jking added the
bug
label 5 years ago
jking closed this issue 5 years ago
Sign in to join this conversation.
No Milestone
No Assignees
1 Participants
Notifications
Due Date

No due date set.

Dependencies

This issue currently doesn't have any dependencies.

Loading…
There is no content yet.