adodb/adodb-php

Maintenance release fixing PHP 8.5 compatibility as well as a few other issues.

See Changelog for details

Security release fixing an SQL injection issue in the SQLite3 driver (CVE-2025-54119, see advisory), thanks to Marco Nappi (@mrcnpp).

Also fixes a few bugs in the SQLite3 driver.

See Changelog for details

Security release fixing an SQL injection issue in the PostgreSQL driver (CVE-2025-46337, see advisory), credits to Marco Nappi (@mrcnpp).

Also fixes a couple bugs in the SQLite3 driver and a PHP 8.2 compatibility issue with Active Record.

See Changelog for details.

Long overdue hotfix release.

See Changelog for details.

Maintenance release focusing on PHP 8.x compatibility.

See Changelog for details

Maintenance release focusing mainly on PHP 8 compatibility. The Date/Time library was deprecated and will be removed in 5.23.0.

See Changelog for details

Maintenance release focusing mainly on PHP 8.2 compatibility.

See Changelog for details

Hotfix release, see Changelog

Hotfix release, see Changelog

Fixed

• mssql: Automatic conversion of false to array is deprecated in PHP 8.1 #829
• mysql: Affected_Rows() not returning correct value #820
• mysql: uncaught ValueError exception calling execute() with an empty array #832
• pgsql: Affected_Rows() always returns false on PHP 8.1 #833

Removed

• Legacy mysql, mysqlpo and mysqlt drivers #804

Fixed

• firebird: undefined offset PHP notice in _fetchField() #808
• firebird: PHP deprecation warning in _blobDecode() #811
• firebird: PHP notice when executing query with empty array #812
• firebird: undefined array key with uppercase columns #813
• mysql: regression on setConnectionParameter() #803
• mysql: regression on bulk binding #806
• oci8: fix PHP 8.1 array deprecation warning #817
• memcache: weighted servers not connecting #807
• memcache: $memCacheCompress option ignored by memcached #823
• memcache: use default port in server controller template #824
• xml PHP Notice in dbData::create() #822

Added

• Support for custom MetaTypes, e.g. JSON or GEOMETRY #602 #626 #649
• Use of weighted server groups with Memcached #676
• mssql: implement offsetDate() method #698
• oci8: new ADOConnection::releaseStatement() method #770
• sqlite3 performance monitor stub #661
• sqlite: support blob handling #702

Changed

• firebird: complete overhaul to support latest PHP drivers #710
• mssql: Refactor _fetchField() method #725
• mysql: Support bound variable statements #655
• pgsql: missing standard datatypes #782
• xml: add field comments #732
• loadbalancer: support calling a function upon connection #784
• Code cleanup: PHPDoc, code style, whitespace, PHPStan errors, etc. #774

Deprecated

• Compatibility with PHP < 7.2 #797
• Database Replication add-on #780

Removed

• Compatibility with PHP 5.x #797
• Transpose() function and assorted sub-functions #586
• "proxy" server and client scripts #680

Fixed

• metaIndexes does not return primary key correctly #656
• Uniformize ADOrecordSet::__construct() parameters #772
• Prevent PHP warning when throwing exception with P1 or P2 parameter as array #783
• $dsnType property not defined before use #789
• mysql: Update socket and client flags for ssl #622
• mysql: Handle tables that are reserved words
• #759
• pgsql: prevent AddColumnSQL() from updating existing values when default is changed #635
• pgsql: Refactored _fixblobs() and replaced it with new _prepFields() method #767
• pgsql: Incorrect pg_execute() api calls #768
• pgsql: blobDelete() could silently fail with multiple connections #769
• pdo: ensure bound statements are correctly formatted #695
• perf: fix invalid SQL #753
• sqlite: driver returns incorrect time when using $sysTimeStamp #697
• sqlite: undeclared connection property #713
• xml: Undefined array key error #775
• memcache: library does not initialize correctly #788

Fixed

• Methods return E_DEPRECATED with PHP8.1 #771

Security

• pgsql: authentication bypass in connect functions (CVE-2021-3850) #793

Fixed

• core: Ensure temp $ADODB_COUNTRECS changes really are temporary #761
• mysqli: force error reporting mode to OFF (PHP 8.1 compatibility) #755
• pdo: fix metaIndexes declaration to match parent #717

Fixed

• Fix syntax error in toexport.inc.php #749
• pgsql: fix fetchField() parameter naming #752

Changed

• Standardized source code file headers #728
• Code cleanup: PHPDoc, code style, whitespace, etc. #691 (and others)

Fixed

• Caching in FieldTypesArray() causes problems #687
• setConnectionParameter() method should not be final #694
• Final private methods throw warning (PHP 8) #711
• Fix record count when executing SQL with subqueries #715
• Incorrect handling of $ADODB_QUOTE_FIELDNAMES = true #721
• array to string conversion in adodb_debug_execute() #737
• db2: fix columns always returned in lowercase #719
• PDO: Bind parameters fail if sent in associative array #705
• mssql: _insertid() doesn't work anymore
  #692
• mssql: PHP warnings in dropColumnSQL() #696
• mssql: duplicate key in SQLDate convert formats #748
• mysql: affected_rows() returns number instead of false #604
• mysql: TypeError when calling get/setChangeSet on unset connection (PHP 8) #686
• mysql: TypeError when calling setConnectionParameter() with non-numeric value (PHP 8) #693
• pdo: Affected_Rows() throws Notice and returns 0 when rows affected #733
• pgsql: sub-selects require aliasing #736
• xml: Invalid SQL in extractSchema() #707

Removed

• Use of _ADODB_COUNT as workaround for counting in complex queries (introduced in #88) #715

Fixed

• pgsql: param(0) returns invalid $0 placeholder #682

Includes all fixes from 5.20.20.

Added

• Explicit support for PHP 8 with Composer

Fixed

• Replace adodb_str_replace() calls with str_replace() #646
• pgsql: override ADODB_DataDict::ChangeTableSQL() #634
• sqlite: fix metaIndexes does not return primary key correctly #656
• xmlschema: PHP8 compatibility #658

Removed

• Support for PHP < 5.5.9 #654
• XML-RPC Interface #671
• Magic quotes related code #674

Includes all fixes from 5.20.19.

Added

• adodb: New helper methods: day(), month(), year() #225
• adodb: add Occitan (#285) and Indonesian (#293) translations.
• adodb: add control over BLOB data dictionary feature (NOT NULL, DEFAULT) #292 #478
• mssql: support Windows authentication #353
• mysqli: support SSL connections #415
• pdo/dblib: new driver #496
• pdo/firebird: new driver #378
• loadbalancer: read/write splitting and load balancing across multiple connections, thanks to Mike Benoit #111

Changed

• adodb: addColumnSQL datadict function now supports ENUM data types #26
• adodb: introduce user-defined default Metatype #165
• adodb: AutoExecute validates empty fields array #154
• adodb: Add new value defaulting mode for getInsertSQL() #214
• adodb: Added portable substring method #219
• adodb: Optimize FieldTypesArray with static variable #367
• adodb: Allow output handler to be callable #312
• adodb-time: Add 'W' (week of year) format support in adodb_date() #223
• db2: full driver rewrite #442
• firebird: updated driver, thanks to Lester Caine #201
• mssql: Add Convert on SQLDate Method #304
• mssql: support alternative port in connect #314
• mssql: MetaForeignKeys() not returning all FKs #486
• mssql: support for T-SQL-style square brackets #246
• mssqlnative: add support for 'l' (day of week) format in sqlDate() #232
• mssqlnative: support metaProcedures() method #578
• setConnectionParameter() now allows multiple parameters with the same key value #187
• mysqli: Insert_ID() did not return correct value after executing stored procedure #166
• mysqli: method failed if $associative set true #181
• oci8: provide option to create compact trigger/sequence names #565
• odbc/mssql: fix null strings concatenation issue with SQL server 2012 #148
• odbc/mssql: add missing Concat() method #402
• pdo: add setConnectionParameter support #247
• pdo: add meta extension points #475
• pdo/mysql: add genID() and createSequence() support #465
• pdo/pgsql: Add support for transactions #363
• pdo/sqlsrv: add SetTransactionMode() method #362
• pgsql: optimize version check #334
• pgsql: use postgres9 driver by default #474
• sqlite: Fix Metataypes mapping #177
• sqlite: driver did not support metaForeignKeys #179
• memcache: add support for memcached PECL library #322
• xml: support table 'opt' attribute with mysqli #267
• xml: add support for 'DESCR' tags for tables/fields #265

Deprecated

• mysqli: Deprecate $optionFlags property in favor of standard setConnectionParameter() method #188
• proxy: the client driver and server.php script are deprecated #444

Removed

• adodb: Remove references to obsolete ADOdb Extension #270
• adodb: Remove unneeded ADODB_str_replace function #582
• adodb: Remove useless PHP 4 and 5 version checks #583 #584
• adodb: replace _array_change_key_case() by internal PHP function #587

Fixed

• adodb: Remove useless constructors #171
• adodb: Define default constructor in ADOConnection base class #172
• adodb: Reimplement base methods charMax() and textMax() #183 #220
• adodb: fix getAssoc() #189 #198 #204
• adodb: Improve array identification in ADOrecordset::getAssoc() #101
• adodb: MetaColumns() consistently returns Actual Type by default in all drivers #184 #133
• adodb: getAssoc() should not change case of result set's outermost key #335
• adodb: getAssoc() fix fetch mode #350
• adodb: Replace each() with foreach (PHP 7.2 compatibility) #373
• adodb: fix ADORecordSet constructor signature #278
• adodb: support use of spaces and reserved keywords in replace function #390
• adodb: fix adodb_strip_order_by() to only remove the last order by statement #549
• adodb: fix field names quoting when setting value to null #572
• adodb: fix getAssoc returning key as value column with ADODB_FETCH_BOTH mode #600
• adodb-time: Fix 'Q' (quarter of year) format in adodb_date() #222
• active record: honor column and table name quoting #309
• db2: fix ChangeTableSQL() signature #338
• mssqlnative: Query not returning id #185
• mssqlnative: fix invalid return value for ErrorNo() #298
• mssqlnative: ensure that the bind array is numeric #336
• mssqlnative: fix crash with driver version 5.6 on queries returning no data #492
• mysql: prevent use of driver with PHP >= 7.0 #310
• mysqli: return fields as ADOFieldObject objects #175
• mysqli (perf): tables() method definition inconsistent with parent #435
• mysql: genId() not returning next sequence value #493
• oci8: fix syntax error preventing sequence creation #540
• oci8: remove use of curly braces in string offsets (deprecated in PHP 7.4) #570
• odbc: MetaColumns() can optionally be set to return MetaType for backwards compatibility #184
• pdo: allow loading of subclassed recordset #245
• pdo: fix PHP notice #248
• pdo: fix ADORecordSet class loading #250
• pdo/sqlsrv: fix fetchField() method #251 #234
• pgsql: add CIDR data type to MetaType() #281
• pgsql: fix param number reset with param(false) #380
• pgsql: specialized casts for _recreate_copy_table() #207
• sqlite: _createSuffix is now compatible with parent #178
• sqlite: metaIndexes could not locate indexes on uppercase table name #176
• sqlite: metaIndexes() returns column as array instead of CSV #567
• session: string parameters for assert are deprecated in PHP 7.2 #438
• xml: fix invalid xmlschema03.dtd and descr tag in session schema XML #595

Security

• adodb: prevent SQL injection in SelectLimit() #311
• session: add 'httponly' flag to cookie #190

Fixed

• Fix usage of get_magic_* functions #619 #657
• Fix PHP warning in _rs2rs() function #679
• pdo: Fix Fatal error in _query() #666
• pdo: Fix undefined variable #678
• pgsql: Fix Fatal error in _close() method (PHP8) #666
• pgsql: fix deprecated function aliases (PHP8) #667
• text: fix Cannot pass parameter by reference #668

Changed

• PDO: support persistent connections #650
• mssql: connect to SQL Server database on a specified port #624

Fixed

• DSN database connection with password containing a # fails #651
• Metacolumns returns wrong type for integer fields in MySQL 8 #642
• Uninitialized Variable access in mssqlnative ErrorNo() method #637

Fixed

• mssql: Retrieve error messages early before connection closed #614

Fixed

• core: fix PHP notice in ADOdb_Exception constructor when using transactions #601
• mssql: fix PHP notice due to uninitialized array with PHP 7.4 #608
• active record: Fix UpdateActiveTable failing with mixed case column names #610

Fixed

• mssql: queries are not correctly closed #590

Fixed

• core: remove unnecessary srand() calls #532
• core: Fix getMenu with ADODB_FETCH_BOTH #482
• core: code cleanup for getMenu and related functions #563
• pgsql: stop using obsolete pg_attrdef.adsrc column #562
• pdo/mysql: remove extraneous comma in $fmtTimeStamp #531
• active record: Use ADODB_ASSOC_CASE constant #536
• session: Remove session_module_name('user') calls (PHP 7.2 compatibility) #449
• PHP 7.4 compatibility: fix deprecated usage of join() #547

Fixed

• core: Fix support for getMenu with ADODB_FETCH_ASSOC #460
• perf/mysql: fix tables() function incompatible with parent #435
• perf/mysql: fix error when logging slow queries #463

Security

• security: Denial of service in adodb_date() #467

Fixed

• core: Fix query execution failures with mismatched quotes #420
• ldap: Fix connections using URIs #340
• mssql: Fix Time field format, allowing autoExecute() to inserting time #432
• mssql: Fix Insert_ID returning null with table name in brackets #313
• mssql: Fix count wrapper #423
• oci8: Fix prepared statements failure #318
• oci8po: Fix incorrect query parameter replacements #370
• pdo: fix PHP notice due to uninitialized variable #437

Fixed

• adodb: PHP 7.2 compatibility
  • Replace each() with foreach #373
  • Replace deprecated create_function() calls #404
  • Replace $php_errormsg with error_get_last() #405
• adodb: Don't call dl() when the function is disabled #406
• adodb: Don't bother with magic quotes when not available #407
• adodb: fix potential SQL injection vector in SelectLimit() #190 #311 #401

This release has been withdrawn as it introduced a regression on PHP 5.x. Please use version 5.20.12 or later.

Fixed

• Fix year validation in adodb_validdate() #375
• Release db resource when closing connection #379
• Avoid full file path disclosure in ADOLoadCode() #389
• mssql: fix PHP warning in _adodb_getcount() #359
• mssql: string keys are not allowed in parameters arrays #316
• mysqli: fix PHP warning on DB connect #348
• pdo: fix auto-commit error in sqlsrv #347
• sybase: fix PHP Warning in _connect()/_pconnect #371

Fixed

• mssql: fix syntax error in version matching regex #305

Fixed

• mssql: support MSSQL Server 2016 and later #294
• mssql: fix Find() returning no results #298
• mssql: fix Sequence name forced to 'adodbseq' #295, #300
• mssql: fix GenId() not returning next sequence value with SQL Server 2005/2008 #302
• mssql: fix drop/alter column with existing default constraint #290
• mssql: fix PHP notice in MetaColumns() #289
• oci8po: fix inconsistent variable binding in SelectLimit() #288
• oci8po: fix SelectLimit() with prepared statements #282

Fixed

• oci8po: prevent segfault on PHP 7 #259
• pdo/mysql: Fix MetaTables() method #275

Security

• security: Fix SQL injection in PDO drivers qstr() method (CVE-2016-7405) #226

Fixed

• adodb: Exit with error/exception when the ADOdb Extension is loaded #269
• adodb: Fix truncated exception messages #273

Security

• security: Fix XSS vulnerability in old test script (CVE-2016-4855) #274

Fixed

• adodb: Fix fatal error when connecting with missing extension #254
• adodb: Fix _adodb_getcount() #236
• mssql: Destructor fails if recordset already closed #268
• mssql: Use SQL server native data types if available #234
• mysqli: Fix PHP notice in _close() method #240
• pdo: Let driver handle SelectDB() and SQLDate() calls #242
• xml: Fix PHP strict warning #260
• xml: remove calls to 'unset($this)' (PHP 7.1 compatibility) #257

Fixed

• adodb: Fix BulkBind() param count validation #199
• mysqli: fix PHP warning in recordset destructor #217
• mysqli: cast port number to int when connecting (PHP7 compatibility) #218

Fixed

• mssql: PHP warning when closing recordset from destructor not fixed in v5.20.2 #180

Fixed

• adodb: Remove a couple leftover PHP 4.x constructors (PHP7 compatibility) #139
• db2ora: Remove deprecated preg_replace '/e' flag (PHP7 compatibility) #168
• mysql: MoveNext() now respects ADODB_ASSOC_CASE #167
• mssql, mysql, informix: Avoid PHP warning when closing recordset from destructor #170

Fixed

• adodb: Fix regression introduced in 5.20.0, causing a PHP Warning when calling GetAssoc() on an empty recordset #162
• ADOConnection::Version() now handles SemVer #164

Added

• adodb: new setConnectionParameter() method, previously implemented in mssqlnative driver only #158.
• pdo: new sqlsrv driver, thanks to MarcelTO #81
• adodb: support for pagination with complex queries, thanks to Mike Benoit #88
• pdo/mysql: New methods to make the driver behave more like mysql/mysqli, thanks to Andy Theuninck #40

Changed

• adodb: Define DB_AUTOQUERY_* constants in main include file #49
• adodb: Add mssql's DATETIME2 type to ADOConnection::MetaType(), thanks to MarcelTO #80
• adodb: Initialize charset in ADOConnection::SetCharSet #39
• adodb: Parse port out of hostname if specified in connection parameters, thanks to Andy Theuninck #63
• adodb: Improve compatibility of ADORecordSet_empty, thanks to Sjan Evardsson #43
• mssqlnative: Use ADOConnection::outp instead of error_log #12

Fixed

• adodb: Fix regression introduced in v5.19, causing queries to return empty rows #20 #93 #95
• adodb: Fix regression introduced in v5.19 in GetAssoc() with ADODB_FETCH_ASSOC mode and '0' as data #102
• adodb: AutoExecute correctly handles empty result set in case of updates #13
• adodb: Fix regex in Version() #16
• adodb: Align method signatures to definition in parent class ADODB_DataDict #31
• adodb: fix ADODB_Session::open() failing after successful ADONewConnection() call, thanks to Sjan Evardsson #44
• adodb: Only include memcache library once for PHPUnit 4.x, thanks to Alan Farquharson #74
• adodb: Move() returns false when given row is < 0, thanks to Mike Benoit.
• adodb: Fix inability to set values from 0 to null (and vice versa) with Active Record, thanks to Louis Johnson #71
• adodb: Fix PHP strict warning in ADODB_Active_Record::Reload(), thanks to Boštjan Žokš #75
• adodb: When flushing cache, initialize it if it is not set, thanks to Paul Haggart #57
• adodb: Improve documentation of fetch mode and assoc case
• adodb: Improve logic to build the assoc case bind array
• adodb: Strict-standards compliance for function names #18 #142
• adodb: Remove old PHP 4.x constructors for compatibility with PHP 7 #139
• adodb: Fix incorrect handling of input array in Execute() #146
• adodb: Release Recordset when raising exception #143
• adodb-lib: Optimize query pagination, thanks to Mike Benoit #110
• memcache: use include_once() to avoid issues with PHPUnit. See PHPLens Issue No: 19489
• mssql_n: Allow use of prepared statements with driver #22
• mssqlnative: fix failure on Insert_ID() if the insert statement contains a semicolon in a value string, thanks to sketule #96
• mssqlnative: Fix "invalid parameter was passed to sqlsrv_configure" error, thanks to Ray Morris #103
• mssqlnative: Fix insert_ID() failing if server returns more than 1 row, thanks to gitjti #41
• mysql: prevent race conditions when creating/dropping sequences, thanks to MikeB #28
• mysql: Fix adodb_strip_order_by() bug causing SQL error for subqueries with order/limit clause, thanks to MikeB.
• mysql: workaround for HHVM behavior, thanks to Mike Benoit.
• mysqli: Fix qstr() when called without an active connection #11
• oci8: Fix broken quoting of table name in AddColumnSQL and AlterColumnSQL, thanks to Andreas Fernandez #67
• oci8: Allow oci8 driver to use lowercase field names in assoc mode #21
• oci8po: Prevent replacement of '?' within strings, thanks to Mark Newnham #132
• pdo: Added missing property (fixes PHP notices) #56
• pdo: Align method signatures with parent class, thanks to Andy Theuninck #62
• postgres: Stop using legacy function aliases
• postgres: Fix AlterColumnSQL when updating multiple columns, thanks to Jouni Ahto #72
• postgres: Fix support for HHVM 3.6, thanks to Mike Benoit #87
• postgres: Noblob optimization, thanks to Mike Benoit #112
• postgres7: fix system warning in MetaColumns() with schema. See PHPLens Issue No: 19481
• sqlite3: ServerInfo() now returns driver's version
• sqlite3: Fix wrong connection parameter in _connect(), thanks to diogotoscano #51
• sqlite3: Fix FetchField, thanks to diogotoscano #53
• sqlite3: Fix result-less SQL statements executed twice #99
• sqlite3: use -1 for _numOfRows #151
• xmlschema: Fix ExtractSchema() when given $prefix and $stripprefix parameters, thanks to peterdd #92
• Convert languages files to UTF-8, thanks to Marc-Etienne Vargenau #32