PdoPlaceholderBindingMismatch

error native on by default

Group: Probable bugs

Detect execute on a resolved PDOStatement whose literal prepared SQL requires markers absent from the complete effective binding set, or whose binding set has extra markers.

Example

<?php
function bad(PDO $pdo) { $s = $pdo->prepare('SELECT :id'); $s->execute(['other' => 2]); }

Reported:

• line 2: Match SQL placeholders to the effective parameter bindings.

Detection

• Report execute on a resolved PDOStatement whose literal prepared SQL requires markers absent from the complete effective binding set, or whose binding set has extra markers.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• Unknown SQL, unknown parameter spreads, unknown earlier bindings and driver-specific unresolved statements are excluded; parse quoted literals and comments before counting markers.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.
• When execute() receives no parameter array and the statement variable is captured by a closure (use ($s), by value or by reference) or referenced inside an arrow function written before the call, that callable may bind markers out of sight, so the earlier bindings are unknown and nothing is reported. A callable written after the call does not hide the mismatch, and an explicit parameter array is still checked because it alone supplies the values.

Fix

No automatic fix: missing parameter values and extra-binding intent cannot be inferred.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "PdoPlaceholderBindingMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PdoPlaceholderBindingMismatch