PdoBoundValueAssumedLive

warning native off by default

Group: Probable bugs

Identify execute without parameters when a locally bound scalar variable was reassigned after bindValue and no rebind occurred. Only track resolved PDOStatement and same variable used as binding input; changing it may be intentional so disabled by default.

Detection

• Report execute without parameters when a locally bound scalar variable was reassigned after bindValue and no rebind occurred. Only track resolved PDOStatement and same variable used as binding input; changing it may be intentional so disabled by default.
• D1a. A later bindValue or bindParam on the same statement counts as a rebind when it can target the same placeholder. Two statically known names are the same placeholder when they are equal after dropping one leading : from each (':n' and 'n' address one placeholder); two statically known positions must be equal; a name never matches a position. When either placeholder argument is not statically known, the later binding is assumed to rebind.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• No report when a later binding on the statement may address the bound placeholder (D1a), including a name spelled with or without its colon and a dynamic name or position.
• Both @custos-ignore PdoBoundValueAssumedLive and @noinspection PdoBoundValueAssumedLive suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "PdoBoundValueAssumedLive": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PdoBoundValueAssumedLive