Add a hard exception if more values provided than parameters

Author: kamil-tekiela

ext/mysqli/mysqli_api.c

@@ -828,6 +828,11 @@ PHP_FUNCTION(mysqli_stmt_execute)
 		unsigned int index;
 		MYSQLND_PARAM_BIND	*params;
 
+		if(zend_hash_num_elements(Z_ARRVAL_P(input_params)) > mysql_stmt_param_count(stmt->stmt)) {
+			zend_argument_count_error("The number of values must match the number of parameters in the prepared statement");
+			RETURN_THROWS();
+		}
+
 		params = mysqlnd_stmt_alloc_param_bind(stmt->stmt);
 		if (!params) {
 			// can we safely return here?

ext/mysqli/tests/mysqli_stmt_execute_bind.phpt

@@ -43,57 +43,66 @@ if (mysqli_get_server_version($link) <= 40100) {
     }
     $stmt = null;
 
-    // 3. param number has to match - missing all parameters
+    // 3. Too many parameters 
+    $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
+    try {
+        $stmt->execute([&$abc, null, $id, 24]);
+    } catch (ArgumentCountError $e) {
+        echo '[002] '.$e->getMessage()."\n";
+    }
+    $stmt = null;
+
+    // 4. param number has to match - missing all parameters
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     try {
         $stmt->execute([]);
     } catch (mysqli_sql_exception $e) {
-        echo '[002] '.$e->getMessage()."\n";
+        echo '[003] '.$e->getMessage()."\n";
     }
     $stmt = null;
 
-    // 4. param number has to match - missing argument to execute()
+    // 5. param number has to match - missing argument to execute()
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     try {
         $stmt->execute();
     } catch (mysqli_sql_exception $e) {
-        echo '[003] '.$e->getMessage()."\n";
+        echo '[004] '.$e->getMessage()."\n";
     }
     $stmt = null;
 
-    // 5. wrong argument to execute()
+    // 6. wrong argument to execute()
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     try {
         $stmt->execute(42);
     } catch (TypeError $e) {
-        echo '[004] '.$e->getMessage()."\n";
+        echo '[005] '.$e->getMessage()."\n";
     }
     $stmt = null;
 
-    // 6. objects are not arrays and are not accepted
+    // 7. objects are not arrays and are not accepted
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     try {
         $stmt->execute((object)[&$abc, 42, $id]);
     } catch (TypeError $e) {
-        echo '[005] '.$e->getMessage()."\n";
+        echo '[006] '.$e->getMessage()."\n";
     }
     $stmt = null;
 
-    // 7. arrays by reference work too
+    // 8. arrays by reference work too
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     $arr = [&$abc, 42, $id];
     $arr2 = &$arr;
     $stmt->execute($arr2);
     assert($stmt->get_result()->fetch_assoc() === ['label'=>'a', 'anon'=>'abc', 'num' => '42']);
     $stmt = null;
 
-    // 8. no placeholders in statement. params are ignored
+    // 9. no placeholders in statement. nothing to bind in an empty array
     $stmt = $link->prepare('SELECT label FROM test WHERE id=1');
-    $stmt->execute(['I am ignored']);
+    $stmt->execute([]);
     assert($stmt->get_result()->fetch_assoc() === ['label'=>'a']);
     $stmt = null;
 
-    // 9. once bound the values are persisted. Just like in PDO
+    // 10. once bound the values are persisted. Just like in PDO
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     $stmt->execute(['abc', 42, $id]);
     assert($stmt->get_result()->fetch_assoc() === ['label'=>'a', 'anon'=>'abc', 'num' => '42']);
@@ -102,29 +111,23 @@ if (mysqli_get_server_version($link) <= 40100) {
     try {
         $stmt->execute([]); // no params here. PDO doesn't throw an error, but mysqli does
     } catch (mysqli_sql_exception $e) {
-        echo '[006] '.$e->getMessage()."\n";
+        echo '[007] '.$e->getMessage()."\n";
     }
     $stmt = null;
 
-    // 10. mixing binding styles not possible. Also, NULL should stay NULL when bound as string
+    // 11. mixing binding styles not possible. Also, NULL should stay NULL when bound as string
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     $stmt->bind_param('sss', ...['abc', 42, null]);
     $stmt->execute([null, null, $id]);
     assert($stmt->get_result()->fetch_assoc() === ['label'=>'a', 'anon'=>null, 'num' => null]);
     $stmt = null;
 
-    // 11. array keys are ignored. Even numerical indices are not considered (PDO does a weird thing with the numerical indices)
+    // 12. array keys are ignored. Even numerical indices are not considered (PDO does a weird thing with the numerical indices)
     $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
     $stmt->execute(['A'=>'abc', 2=>42, null=>$id]);
     assert($stmt->get_result()->fetch_assoc() === ['label'=>'a', 'anon'=>'abc', 'num' => '42']);
     $stmt = null;
 
-    // 12. Too many parameters is not a problem. The redundant ones just get ignored
-    $stmt = $link->prepare('SELECT label, ? AS anon, ? AS num FROM test WHERE id=?');
-    $stmt->execute(['abc', null, $id, 42]);
-    assert($stmt->get_result()->fetch_assoc() === ['label'=>'a', 'anon'=>'abc', 'num' => null]);
-    $stmt = null;
-
 
     mysqli_close($link);
     print "done!";
@@ -135,9 +138,10 @@ if (mysqli_get_server_version($link) <= 40100) {
 ?>
 --EXPECT--
 [001] No data supplied for 1 parameter in prepared statement
-[002] No data supplied for 3 parameters in prepared statement
-[003] No data supplied for parameters in prepared statement
-[004] mysqli_stmt::execute(): Argument #1 ($params) must be of type ?array, int given
-[005] mysqli_stmt::execute(): Argument #1 ($params) must be of type ?array, stdClass given
-[006] No data supplied for 3 parameters in prepared statement
+[002] The number of values must match the number of parameters in the prepared statement
+[003] No data supplied for 3 parameters in prepared statement
+[004] No data supplied for parameters in prepared statement
+[005] mysqli_stmt::execute(): Argument #1 ($params) must be of type ?array, int given
+[006] mysqli_stmt::execute(): Argument #1 ($params) must be of type ?array, stdClass given
+[007] No data supplied for 3 parameters in prepared statement
 done!