PDO::ATTR_EMULATE_PREPARES Security Issue about msphpsql

[SumoLion]

Hello @david-garcia-garcia

I don't think this is a mistake in the documentation, nor a bug in the PDO driver. When you call Prepare with the ATTR_EMULATE_PREPARES flag set to true, you are explicitly bypassing the driver's call through to the server to actually prepare the statement. The line before the beginning of your quote from the docs:"If your PHP application must use parameters in a Transact-SQL clause that will generate an error on the server, you can set the PDO::ATTR_EMULATE_PREPARES attribute to true. ". The reason you might choose to set emulate prepares attribute is to allow your application to dynamically alter parts of a SQL statement that the server does not support parameterizing, and therefore can't prepare. What the note is warning you about is that, as in any dynamically generated SQL statement, your application needs to ensure that the strings you are using to construct it are clean.

[david-garcia-garcia]

Thanks for the quick reply, I'll share this feedback with the people involved in the issue.