PdoIdentifierPlaceholder

error native on by default

Group: Probable bugs

Detect PDO prepare with a named or positional parameter marker in a table-name position following FROM, JOIN, UPDATE, INTO or TABLE in parsed literal SQL.

Example

<?php
function bad(PDO $pdo) { $pdo->prepare('SELECT * FROM :table'); }
function alsoBad(PDO $pdo) { $pdo->prepare('DELETE FROM ? WHERE id = 1'); }
function fine(PDO $pdo) { $pdo->prepare('SELECT EXTRACT(YEAR FROM :day) WHERE :a IS DISTINCT FROM :b'); }

Reported:

• line 2: Select SQL identifiers from a trusted allowlist.
• line 3: Select SQL identifiers from a trusted allowlist.

Detection

• Report PDO prepare when the parsed literal SQL has a parameter marker, named (:name) or positional (?), as the first token after one of the keywords FROM, JOIN, UPDATE, INTO or TABLE. Only whitespace and comments may separate the keyword from the marker; keywords are matched case-insensitively. The rule applies at any parenthesis depth, so a subquery's table reference counts.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• String literals, comments, valid value markers, unresolved SQL grammar and dynamic identifiers already selected from a validated allowlist are excluded.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.
• A FROM that separates function arguments or belongs to a comparison does not open a table reference, so a marker after it is an ordinary value: IS [NOT] DISTINCT FROM, and a FROM written directly inside the parentheses of EXTRACT, SUBSTRING, SUBSTR, MID, TRIM or OVERLAY. A nested parenthesis inside such a call (a subquery) is judged on its own.

Fix

No automatic fix: permitted identifiers and quoting policy must be supplied by the caller.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "PdoIdentifierPlaceholder": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PdoIdentifierPlaceholder