Skip to content

Conversation

@morozov
Copy link
Member

@morozov morozov commented Jul 18, 2025

The DBAL, when building a CREATE USER statement, uses the password as is w/o any escaping. This way, it will fail to create the user if the password contains special characters. For example:

SQL> create user bob identified by Password!;
create user bob identified by Password!
                                      *
ERROR at line 1:
ORA-00922: missing or invalid option
Help: https://docs.oracle.com/error-help/db/ora-00922/

Per the documentation,

Passwords must follow the rules described in the section "Schema Object Naming Rules" [...]

Which documents the common quoting rules:

Nonquoted identifiers can contain only alphanumeric characters [...]

Quoted identifiers can contain any characters and punctuations marks as well as spaces [...]

Which basically means that we need to quote the password:

SQL> create user bob identified by "Passw0rd!";
User created.

In my understanding, unlike other database objects, passwords are always case-sensitive, even if declared as unquoted. So it's not a breaking change. Furthermore, I very much doubt that this method is used for anything else than testing (the method creates a new user with the same password as the password of the current user).

@morozov morozov added this to the 4.3.1 milestone Jul 18, 2025
@morozov morozov requested review from derrabus and greg0ire July 18, 2025 19:13
@morozov morozov merged commit d976b30 into doctrine:4.3.x Jul 20, 2025
86 checks passed
@morozov morozov deleted the oracle-quote-password branch July 20, 2025 14:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants