Annotation of embedaddon/php/ext/pdo_mysql/tests/bug41125.phpt, revision 1.1
1.1 ! misho 1: --TEST--
! 2: Bug #41125 (PDO mysql + quote() + prepare() can result in seg fault)
! 3: --SKIPIF--
! 4: <?php
! 5: require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
! 6: require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
! 7: MySQLPDOTest::skip();
! 8:
! 9: ?>
! 10: --FILE--
! 11: <?php
! 12:
! 13: require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
! 14:
! 15: $db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
! 16:
! 17: $search = "o'";
! 18: $sql = "SELECT 1 FROM DUAL WHERE 'o''riley' LIKE " . $db->quote('%' . $search . '%');
! 19: $stmt = $db->prepare($sql);
! 20: $stmt->execute();
! 21: print implode(' - ', (($r = @$stmt->fetch(PDO::FETCH_NUM)) ? $r : array())) ."\n";
! 22: print implode(' - ', $stmt->errorinfo()) ."\n";
! 23:
! 24: print "-------------------------------------------------------\n";
! 25:
! 26: $queries = array(
! 27: "SELECT 1 FROM DUAL WHERE 1 = '?\'\''",
! 28: "SELECT 'a\\'0' FROM DUAL WHERE 1 = ?",
! 29: "SELECT 'a', 'b\'' FROM DUAL WHERE '''' LIKE '\\'' AND ?",
! 30: "SELECT 'foo?bar', '', '''' FROM DUAL WHERE ?"
! 31: );
! 32:
! 33: foreach ($queries as $k => $query) {
! 34: $stmt = $db->prepare($query);
! 35: $stmt->execute(array(1));
! 36: printf("[%d] Query: [[%s]]\n", $k + 1, $query);
! 37: print implode(' - ', (($r = @$stmt->fetch(PDO::FETCH_NUM)) ? $r : array())) ."\n";
! 38: print implode(' - ', $stmt->errorinfo()) ."\n";
! 39: print "--------\n";
! 40: }
! 41:
! 42: $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 1);
! 43: $sql = "SELECT upper(:id) FROM DUAL WHERE '1'";
! 44: $stmt = $db->prepare($sql);
! 45:
! 46: $id = 'o\'\0';
! 47: $stmt->bindParam(':id', $id);
! 48: $stmt->execute();
! 49: printf("Query: [[%s]]\n", $sql);
! 50: print implode(' - ', (($r = @$stmt->fetch(PDO::FETCH_NUM)) ? $r : array())) ."\n";
! 51: print implode(' - ', $stmt->errorinfo()) ."\n";
! 52:
! 53: print "-------------------------------------------------------\n";
! 54:
! 55: $queries = array(
! 56: "SELECT 1, 'foo' FROM DUAL WHERE 1 = :id AND '\\0' IS NULL AND 2 <> :id",
! 57: "SELECT 1 FROM DUAL WHERE 1 = :id AND '' AND 2 <> :id",
! 58: "SELECT 1 FROM DUAL WHERE 1 = :id AND '\'\'' = '''' AND 2 <> :id",
! 59: "SELECT 1 FROM DUAL WHERE 1 = :id AND '\'' = '''' AND 2 <> :id",
! 60: "SELECT 'a', 'b\'' FROM DUAL WHERE '''' LIKE '\\'' AND 1",
! 61: "SELECT 'a''', '\'b\'' FROM DUAL WHERE '''' LIKE '\\'' AND 1",
! 62: "SELECT UPPER(:id) FROM DUAL WHERE '1'",
! 63: "SELECT 1 FROM DUAL WHERE '\''",
! 64: "SELECT 1 FROM DUAL WHERE :id AND '\\0' OR :id",
! 65: "SELECT 1 FROM DUAL WHERE 'a\\f\\n\\0' AND 1 >= :id",
! 66: "SELECT 1 FROM DUAL WHERE '\'' = ''''",
! 67: "SELECT '\\n' '1 FROM DUAL WHERE '''' and :id'",
! 68: "SELECT 1 'FROM DUAL WHERE :id AND '''' = '''' OR 1 = 1 AND ':id",
! 69: );
! 70:
! 71: $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 1);
! 72: $id = 1;
! 73:
! 74: foreach ($queries as $k => $query) {
! 75: $stmt = $db->prepare($query);
! 76: $stmt->bindParam(':id', $id);
! 77: $stmt->execute();
! 78:
! 79: printf("[%d] Query: [[%s]]\n", $k + 1, $query);
! 80: print implode(' - ', (($r = @$stmt->fetch(PDO::FETCH_NUM)) ? $r : array())) ."\n";
! 81: print implode(' - ', $stmt->errorinfo()) ."\n";
! 82: print "--------\n";
! 83: }
! 84:
! 85: ?>
! 86: --EXPECT--
! 87: 1
! 88: 00000 - -
! 89: -------------------------------------------------------
! 90: [1] Query: [[SELECT 1 FROM DUAL WHERE 1 = '?\'\'']]
! 91:
! 92: 00000 - -
! 93: --------
! 94: [2] Query: [[SELECT 'a\'0' FROM DUAL WHERE 1 = ?]]
! 95: a'0
! 96: 00000 - -
! 97: --------
! 98: [3] Query: [[SELECT 'a', 'b\'' FROM DUAL WHERE '''' LIKE '\'' AND ?]]
! 99: a - b'
! 100: 00000 - -
! 101: --------
! 102: [4] Query: [[SELECT 'foo?bar', '', '''' FROM DUAL WHERE ?]]
! 103: foo?bar - - '
! 104: 00000 - -
! 105: --------
! 106: Query: [[SELECT upper(:id) FROM DUAL WHERE '1']]
! 107: O'\0
! 108: 00000 - -
! 109: -------------------------------------------------------
! 110: [1] Query: [[SELECT 1, 'foo' FROM DUAL WHERE 1 = :id AND '\0' IS NULL AND 2 <> :id]]
! 111:
! 112: 00000 - -
! 113: --------
! 114: [2] Query: [[SELECT 1 FROM DUAL WHERE 1 = :id AND '' AND 2 <> :id]]
! 115:
! 116: 00000 - -
! 117: --------
! 118: [3] Query: [[SELECT 1 FROM DUAL WHERE 1 = :id AND '\'\'' = '''' AND 2 <> :id]]
! 119:
! 120: 00000 - -
! 121: --------
! 122: [4] Query: [[SELECT 1 FROM DUAL WHERE 1 = :id AND '\'' = '''' AND 2 <> :id]]
! 123: 1
! 124: 00000 - -
! 125: --------
! 126: [5] Query: [[SELECT 'a', 'b\'' FROM DUAL WHERE '''' LIKE '\'' AND 1]]
! 127: a - b'
! 128: 00000 - -
! 129: --------
! 130: [6] Query: [[SELECT 'a''', '\'b\'' FROM DUAL WHERE '''' LIKE '\'' AND 1]]
! 131: a' - 'b'
! 132: 00000 - -
! 133: --------
! 134: [7] Query: [[SELECT UPPER(:id) FROM DUAL WHERE '1']]
! 135: 1
! 136: 00000 - -
! 137: --------
! 138: [8] Query: [[SELECT 1 FROM DUAL WHERE '\'']]
! 139:
! 140: 00000 - -
! 141: --------
! 142: [9] Query: [[SELECT 1 FROM DUAL WHERE :id AND '\0' OR :id]]
! 143: 1
! 144: 00000 - -
! 145: --------
! 146: [10] Query: [[SELECT 1 FROM DUAL WHERE 'a\f\n\0' AND 1 >= :id]]
! 147:
! 148: 00000 - -
! 149: --------
! 150: [11] Query: [[SELECT 1 FROM DUAL WHERE '\'' = '''']]
! 151: 1
! 152: 00000 - -
! 153: --------
! 154: [12] Query: [[SELECT '\n' '1 FROM DUAL WHERE '''' and :id']]
! 155:
! 156: 1 FROM DUAL WHERE '' and :id
! 157: 00000 - -
! 158: --------
! 159: [13] Query: [[SELECT 1 'FROM DUAL WHERE :id AND '''' = '''' OR 1 = 1 AND ':id]]
! 160: 1
! 161: 00000 - -
! 162: --------
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to bug41125.phpt CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / ext / pdo_mysql / tests