Consider disabling PDO emulated query parser by default

Description

This is a copy of https://github.com/doctrine/dbal/issues/7146 opened at doctrine/dbal, as the same change can be considered in php-src as well.

I've been linked to a quite interesting article regarding possible SQL injection when using PDO: https://slcyber.io/assetnote-security-research-center/a-novel-technique-for-sql-injection-in-pdos-prepared-statements/. It describes a method that confuses the PDO emulated query parser into something that shouldn't happen with bound parameters, which in certain scenarios can be used to execute SQL injection.

This brings the question: why should we even want to use this emulation? From my understanding this is an artifact from the past, where the common consensus was that it would benefit performance as prepared statements would skip the query cache with older MySQL versions. But is that still relevant today?

Which is why I'd like to open a discussion: should pdo_mysql consider setting the PDO::ATTR_EMULATE_PREPARES to false by default?

Proof of concept with doctrine:

$address = $request->query->getString('q'); // http://somehost/some/page?q=?%00
dd($this
  ->getEntityManager()
  ->getConnection()
  ->executeStatement("SELECT * FROM address WHERE address1 LIKE '%$address%' AND city = ?", ['enschede'])
);

Which throws SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens, which is solved by adding ->option(PDO::ATTR_EMULATE_PREPARES, false) to the dbal driver configuration.

PHP Version

PHP 8.4.12 (cli) (built: Sep  7 2025 14:04:14) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.12, Copyright (c), by Zend Technologies
    with Xdebug v3.4.5, Copyright (c) 2002-2025, by Derick Rethans

Operating System

No response

pdo_mysql の実装と PDO::ATTR_EMULATE_PREPARES の扱いから始めます。リンクされたセキュリティ調査と既存のテストまたはデフォルト値を確認し、完了とみなすべき動作と回帰テストのカバレッジを決定する前に、互換性とパフォーマンスへの影響を明らかにします。