diff options
| author | Andrey Hristov <andrey@php.net> | 2013-11-26 19:15:12 +0200 |
|---|---|---|
| committer | Andrey Hristov <andrey@php.net> | 2013-11-26 19:15:12 +0200 |
| commit | 0aadab0e2eb101953ceb60b63f6ac157f7e03b03 (patch) | |
| tree | 257262936499d4cc2e79bfdbf1df45e1e80c3d17 | |
| parent | 74ba88e186a0f70caa6e8e5a440a3a204afabf50 (diff) | |
| download | php-git-0aadab0e2eb101953ceb60b63f6ac157f7e03b03.tar.gz | |
add test
| -rw-r--r-- | ext/pdo_mysql/tests/bug66141.phpt | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/ext/pdo_mysql/tests/bug66141.phpt b/ext/pdo_mysql/tests/bug66141.phpt new file mode 100644 index 0000000000..3a28509314 --- /dev/null +++ b/ext/pdo_mysql/tests/bug66141.phpt @@ -0,0 +1,38 @@ +--TEST-- +Bug #66141 (mysqlnd quote function is wrong with NO_BACKSLASH_ESCAPES after failed query) +--SKIPIF-- +<?php +require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc'); +require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc'); +MySQLPDOTest::skip(); +?> +--FILE-- +<?php +include __DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc'; +$db = MySQLPDOTest::factory(); + +$input = 'Something\', 1 as one, 2 as two FROM dual; -- f'; + +$quotedInput0 = $db->quote($input); + +$db->query('set session sql_mode="NO_BACKSLASH_ESCAPES"'); + +// injection text from some user input + +$quotedInput1 = $db->quote($input); + +$db->query('something that throws an exception'); + +$quotedInput2 = $db->quote($input); + +var_dump($quotedInput0); +var_dump($quotedInput1); +var_dump($quotedInput2); +?> +done +--EXPECTF-- +Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'something that throws an exception' at line %d in %s on line %d +string(50) "'Something\', 1 as one, 2 as two FROM dual; -- f'" +string(50) "'Something'', 1 as one, 2 as two FROM dual; -- f'" +string(50) "'Something'', 1 as one, 2 as two FROM dual; -- f'" +done
\ No newline at end of file |