PDO: support `bindValue` based api

[staabm]

example

https://github.com/shopware/shopware/blob/f5146152531467ddd39c7f91b5d7f74f027ca6fc/engine/Shopware/Components/Session/PdoSessionHandler.php?rgh-link-date=2022-01-24T08%3A52%3A08Z#L319-L335

[xPaw]

There are also bindColumn and bindParam.

[xPaw]

I tried looking at this, but I can't really wrap my head around php-parser's AST.

It seems that it would be pretty similar to findQueryStringExpression, where it finds the parent node, and then traverses the children for all the bind* calls.

[staabm]

It seems that it would be pretty similar to findQueryStringExpression, where it finds the parent node, and then traverses the children for all the bind* calls.

exactly. we can only support use-cases where the bindValue (et. all) and the execute are done within the same method.

similar to https://github.com/staabm/phpstan-dba/blob/main/src/Extensions/PdoStatementExecuteTypeSpecifyingExtension.php in which we find the corresponding sql query arg of ->prepare() which needs to be executed starting from the line where execute() is called

[staabm]

I tried looking at this, but I can't really wrap my head around php-parser's AST.

for those cases I put the unit test code into https://phpast.com/ and inspect the AST which gets generated. it helps to find the proper traversing.

[xPaw]

While there's basic support for this now, there's still things to do. In particular with bind calls being inside of if statements.

As well as bind calls should be an error when there are also parameters being passed into execute.

Not sure if it's worth exploring support for passing in PDO::PARAM_* as third argument in bind calls.

[staabm]

I agree in all mentioned points.

We should tackle them one at a time