odbc_connect does not pass authentication information to the driver under certain conditions

[SakiTakamachi]

Description

These are the problems that I found out while investigating various things because #12295, which is a fix PR for #12251, did not work properly.

1. If we pass an empty string for the password, the authentication information will not be passed in DSN when direct.

odbc_connect('Driver=FreeTDS;Server=mssql-server;Port=1433;Database=test', 'test_user2', ''); // my env

gdb

2138				rc = SQLDriverConnect((*conn)->hdbc, NULL, (SQLCHAR *) ldb, strlen(ldb), dsnbuf, sizeof(dsnbuf) - 1, &dsnbuflen, SQL_DRIVER_NOPROMPT);
(gdb) p ldb
$1 = 0x7f45d265b240 "Driver=FreeTDS;Server=mssql-server;Port=1433;Database=test"

2. If only one of uid or pwd is included in the dsn, the other will not be included in the built dsn.

odbc_connect('Driver=FreeTDS;Server=mssql-server;Port=1433;Database=test;uid=test_user', 'test_user', 'p@ssw0rd'); // my env

gdb

2138				rc = SQLDriverConnect((*conn)->hdbc, NULL, (SQLCHAR *) ldb, strlen(ldb), dsnbuf, sizeof(dsnbuf) - 1, &dsnbuflen, SQL_DRIVER_NOPROMPT);
(gdb) p ldb
$1 = 0x7f089467f000 "Driver=FreeTDS;Server=mssql-server;Port=1433;Database=test;uid=test_user"

PHP Version

PHP8.2+

Operating System

Ubuntu22.04 (docker image)

[NattyNarwhal]

For the audience at home: The logic in ODBC and PDO_ODBC. Both of those need to be a valid non-empty string (and the corresponding thing not to be set in the connection string) for the extensions to append UID and PWD.

[SakiTakamachi]

So this is by design and not a bug?

[NattyNarwhal]

Looks like it; it's a cleaned up version of what it used to do before quoting. I don't know if it's as much design as "it organically grew that way". Documentation never mentioned the behaviour of appending uid/pwd to a connection string, so it seems like an implementation detail.

(edit: The behaviour probably should be mentioned in the docs. They right now basically make very little mention of the difference between when the driver does SQLConnect w/ DSN vs. SQLDriverConnect w/ connection string and appending behavour)

[SakiTakamachi]

Users whose password is set to an empty string will be unable to connect unless they include authentication information in the first argument. I think this is a problem, but is it?

[NattyNarwhal]

Most DBMSes I've seen usually don't allow you to log in with a blank password (the one I have familiarity with, Db2i, makes you pass a special value on PWD to not use a password). But IIRC, but it might present a problem for the ones that do. So, I'm not opposed to a change that removes the empty string check.

[SakiTakamachi]

It seems that the bug-like behavior can be resolved by unchecking the empty string for the time being.

Personally, I think it would be better to make the second and third arguments optional, what do you think?

Also, I think it is better to determine whether uid and pwd are included in the first argument individually.

[NattyNarwhal]

Right. It does make the string format a little more complex, but makes more sense.

[SakiTakamachi]

Thank you. Target 8.2 for empty strings. Others are probably better directed to master.

I'll try creating a PR.