[rootindex]

What

• The agent replaces literals in the SQL text of DB spans with ?.
• Literals are quoted strings, numbers, hex and binary values, and comments.
• The new class DbStatementSanitizer does the work. It has one static method.
• DbAutoInstrumentationUtil::beginDbSpan calls it. PDO and MySQLi spans both use that method.
• The sanitized text becomes the span name and context.db.statement.

Why

• #904 asks to remove PII from MySQL query instrumentation.
• #1005 asks to align the span name for SQL queries.
• The OpenTelemetry database conventions cover this in the section "Sanitization of db.query.text".
• The rule says to replace literals in non-parameterized query text with ?.
• Today an email or a token in a query goes to the APM server in clear text.
• The agent cannot tell parameterized from plain statements, so it sanitizes both.
• Placeholders such as ? and :name stay unchanged.

How it behaves on failure

• preg_replace returns null on a PCRE error, for example when it hits pcre.backtrack_limit.
• The statement then becomes null. No unsanitized text leaves the process.
• The span name falls back to the call name, for example PDO::query.
• That fallback is the existing path for spans without a statement.
• The span still starts and ends as before.

Tests

• New class DbStatementSanitizerTest has 33 tests.
• Data sets cover quotes, escapes, numbers, hex, binary, comments and IN lists.
• Data sets also cover identifiers and placeholders that must stay unchanged.
• Two tests run 30 KB literals and expect one ?.
• Three tests call beginDbSpan, with a statement, with a PCRE failure and without a statement.
• The full unit suite passes on PHP 8.4. phpcs, phpstan at level max and parallel-lint pass.
• Component tests did not run locally, because they need the native extension.

Exact-match compression compares span names, so statements that differ only in literals can now merge.

[cla-checker-service]

💚 CLA has been signed

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[rootindex]

CLA signed. Please recheck.