如何检查PHP是否提供了比所需更多的PDO参数 [英] How to check in PHP if more PDO parameters provided than needed

问题描述

我有以下一段代码（PHP 7.3.16）从数据库（MySQL）检索一些数据：

I have following piece of code (PHP 7.3.16) which retrieves some data from database (MySQL):

// db credentials
$dbhost = "localhost";
$dbuser = "user";
$dbpass = "password";
$dbname = "database";

// pdo
$dsn = "mysql:host=".$dbhost.";dbname=".$dbname.";charset=utf8";
$options = [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
  PDO::ATTR_EMULATE_PREPARES => false
];
$pdo = new PDO($dsn, $dbuser, $dbpass, $options);

// run sql query
$sql = "SELECT * FROM foo WHERE bar > ?";

$pdo_parameters = [ 1 ];
// this will produce no results without any error:
// $pdo_parameters = [ 1, 2, 3 ];

$stmt = $pdo->prepare($sql);
$stmt->execute( $pdo_parameters );

while ($row = $stmt->fetch(PDO::FETCH_ASSOC))
{
    var_dump($row);
}

如果数组 $ pdo_parameters 仅包含1个元素，那么一切都按预期工作，并且我收到结果。但是，当 $ pdo_parameters 包含多个时，如果没有任何异常消息，我将不会收到任何结果。 PHP错误有效，但没有看到任何PDO错误消息。为什么？

If array $pdo_parameters contains only 1 element then everything works as expected and I receive a result. However when $pdo_parameters contains more than one I don't receive any results at all without any exception message. PHP errors are active, but I don't see any PDO error message. Why?

如果参数太多，我想提出一个PHP异常。

I would like to raise an PHP exception if there are too many parameters. Is that possible?

Fatal error: Uncaught PDOException: SQLSTATE[HY093]: Invalid parameter number in /tmp/test:42 Stack trace: #0 /tmp/test.php(42): PDOStatement->execute(Array) #1 {main} thrown in /tmp/test.php on line 42

我有一个庞大的代码库，在这种情况下需要适当的异常处理。但是我不明白为什么PHP在这种情况下不会引发异常。这是另一个PHP错误，还是只是没有办法让PHP（PHP C内部人员）检查是否有太多的PDO参数？我知道如何用普通的PHP自行检查（虽然如果我们在某些字符串中包含？，可能会很不准确），但是如果PHP PDO扩展具有可以检查这种情况的函数会更好。

I have a huge code base and need in such cases a proper exception handling. However I don't understand why PHP doesn't raise an exception in that case. Is this just another PHP bug or if there is just no way for PHP (PHP C internals) to check if there are too many PDO parameters? I know how to check that by myself in plain PHP (could be pretty inaccurate though if we have "?" in some strings), but it would be better if PHP PDO extension would have a function to check such cases.

编辑：：这是一个已知的PHP错误： https://bugs.php.net/bug.php?id=77490 （2019年1月20日的首次报告）

It is a known PHP bug: https://bugs.php.net/bug.php?id=77490 (first report from 20 January 2019)

推荐答案

您是对的，这种情况似乎并不会引发异常或引发错误。 PDOStatement :: execute（）至少返回 false ，因此您可以自己滚动：

You're right, that situation doesn't seem to throw exceptions nor trigger errors. PDOStatement::execute() at least returns false so you can roll your own:

$dsn = "mysql:host=$dbhost;dbname=$dbname;charset=utf8mb4";
$options = [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES => false,
];
$pdo = new PDO($dsn, $dbuser, $dbpass, $options);

$sql = 'SELECT ? AS foo';
$stmt = $pdo->prepare($sql);

if (!$stmt->execute([1, 2])) {
    throw new InvalidArgumentException('Failed to execute statement');
}
while ($row = $stmt->fetch()) {
    var_dump($row);
}

不理想，但是...

这篇关于如何检查PHP是否提供了比所需更多的PDO参数的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！