Skip to content

Quote Oracle user password - #7043

Merged
morozov merged 1 commit into
doctrine:4.3.xfrom
morozov:oracle-quote-password
Jul 20, 2025
Merged

morozov merged 1 commit into
doctrine:4.3.xfrom
morozov:oracle-quote-password

Conversation

@morozov

@morozov morozov commented Jul 18, 2025 •

Copy link
Copy Markdown
Member

The DBAL, when building a CREATE USER statement, uses the password as is w/o any escaping. This way, it will fail to create the user if the password contains special characters. For example:

SQL> create user bob identified by Password!;
create user bob identified by Password!
                                      *
ERROR at line 1:
ORA-00922: missing or invalid option
Help: https://docs.oracle.com/error-help/db/ora-00922/

Per the documentation,

Passwords must follow the rules described in the section "Schema Object Naming Rules" [...]

Which documents the common quoting rules:

Nonquoted identifiers can contain only alphanumeric characters [...]

Quoted identifiers can contain any characters and punctuations marks as well as spaces [...]

Which basically means that we need to quote the password:

SQL> create user bob identified by "Passw0rd!";
User created.

In my understanding, unlike other database objects, passwords are always case-sensitive, even if declared as unquoted. So it's not a breaking change. Furthermore, I very much doubt that this method is used for anything else than testing (the method creates a new user with the same password as the password of the current user).

@morozov morozov added this to the 4.3.1 milestone Jul 18, 2025
@morozov
morozov requested review from derrabus and greg0ire July 18, 2025 19:13
@morozov
morozov merged commit d976b30 into doctrine:4.3.x Jul 20, 2025
@morozov
morozov deleted the oracle-quote-password branch July 20, 2025 14:34
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Jul 21, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants