MysqliPlaceholderBindingMismatch

warning native on by default

Group: Probable bugs

Every SQL parameter placeholder needs a corresponding bound value. Match the binding argument count to the prepared statement.

Example

<?php
$db=new mysqli();$s=$db->prepare("SELECT ? + ?");$s->bind_param("i",$id);

Reported:

• line 2: Bind one value for each SQL placeholder.

Detection

• Resolved mysqli::prepare literal SQL produces statement whose bind_param binding argument count differs from SQL question-mark parameter count. Ignore question marks inside SQL quoted strings, backticks and plain comments (#, /* */, and a double dash followed by whitespace or the end of the text). Exclude SQL parse ambiguity and unpacked bindings.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Do not report when the SQL text contains a comment form whose handling depends on the server: an executable or hint comment (opened by /*!, /*M! or /*+), or a double dash immediately followed by a non-whitespace character, which MySQL reads as operators rather than a comment. The test is textual, so the same characters inside quoted data also withhold the report.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "MysqliPlaceholderBindingMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore MysqliPlaceholderBindingMismatch