Consider disabling PDO emulated query parser by default

Description

This is a copy of https://github.com/doctrine/dbal/issues/7146 opened at doctrine/dbal, as the same change can be considered in php-src as well.

I've been linked to a quite interesting article regarding possible SQL injection when using PDO: https://slcyber.io/assetnote-security-research-center/a-novel-technique-for-sql-injection-in-pdos-prepared-statements/. It describes a method that confuses the PDO emulated query parser into something that shouldn't happen with bound parameters, which in certain scenarios can be used to execute SQL injection.

This brings the question: why should we even want to use this emulation? From my understanding this is an artifact from the past, where the common consensus was that it would benefit performance as prepared statements would skip the query cache with older MySQL versions. But is that still relevant today?

Which is why I'd like to open a discussion: should pdo_mysql consider setting the PDO::ATTR_EMULATE_PREPARES to false by default?

Proof of concept with doctrine:

$address = $request->query->getString('q'); // http://somehost/some/page?q=?%00
dd($this
  ->getEntityManager()
  ->getConnection()
  ->executeStatement("SELECT * FROM address WHERE address1 LIKE '%$address%' AND city = ?", ['enschede'])
);

Which throws SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens, which is solved by adding ->option(PDO::ATTR_EMULATE_PREPARES, false) to the dbal driver configuration.

PHP Version

PHP 8.4.12 (cli) (built: Sep  7 2025 14:04:14) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.12, Copyright (c), by Zend Technologies
    with Xdebug v3.4.5, Copyright (c) 2002-2025, by Derick Rethans

Operating System

No response

Start with the pdo_mysql implementation and the handling of PDO::ATTR_EMULATE_PREPARES. Review the linked security research and existing tests or defaults, then establish the compatibility and performance impact before deciding what behavior and regression coverage would constitute done.