mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-06 20:53:00 -05:00
Nic Boet
35a8daf99e
dbConnect() turns emulated prepares off, so every query of the web UI, the ajax calls and the includes the API runs (config, servers, users, permissions) is a server-side prepare: prepare, execute and close, three round trips to the database where one would do. From PHP 8.1, pdo_mysql returns integers and floats as PHP ints and floats with emulated prepares too, so values keep the types they have now. Emulate prepares there and keep server-side prepares on older PHP, where every value would become a string. Emulated prepares quote parameters bound as strings, which breaks LIMIT ?. dbQuery() now binds integer values as integers (everything else as strings, as execute() did), and the log and watch ajax calls cast their validated offset and limit to int. With emulation, PDO would also run several statements given in one string; MYSQL_ATTR_MULTI_STATEMENTS is turned off so that is refused as before. CakePHP's own connection is not changed: it already uses PDO's default, emulated prepares. tests/php/test_database_emulated_prepares.php compares every column of every table read through both kinds of prepare (types and values), checks aggregates, LIMIT with positional and named integers, string and null parameters, and that two statements in one string are refused.