From 080d2345959284dee2312fcdf4c86288a8a6c792 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 24 Aug 2026 12:40:21 -0400
Subject: [PATCH] ext/pdo: Do not register a bindColumn() binding for an
 unknown column

really_register_bound_param() raised the implementation error for a column
name that is not in the result set and then registered the binding anyway,
so bindColumn() returned true for a binding that can never fire, and
repeated failing calls with distinct names grew bound_columns without
bound. Refuse the binding in every error mode instead.

Closes GH-23799
---
 NEWS                                          |  2 +
 ext/pdo/pdo_stmt.c                            |  1 +
 .../tests/pdo_bindcolumn_unknown_column.phpt  | 41 +++++++++++++++++++
 3 files changed, 44 insertions(+)
 create mode 100644 ext/pdo/tests/pdo_bindcolumn_unknown_column.phpt

diff --git a/NEWS b/NEWS
index 982945e5ebfc..b2b134d8535a 100644
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,8 @@ PHP                                                                        NEWS
 - PDO:
   . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
     column index. (Ilia Alshanetsky)
+  . Fixed PDOStatement::bindColumn() registering a binding for a column name
+    that is not in the result set. (Ilia Alshanetsky)
 
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 8612a01e0444..97d1a058fd52 100644
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -311,6 +311,7 @@ static bool really_register_bound_param(struct pdo_bound_param_data *param, pdo_
 			spprintf(&tmp, 0, "Did not find column name '%s' in the defined columns; it will not be bound", ZSTR_VAL(param->name));
 			pdo_raise_impl_error(stmt->dbh, stmt, "HY000", tmp);
 			efree(tmp);
+			return 0;
 		}
 	}
 
diff --git a/ext/pdo/tests/pdo_bindcolumn_unknown_column.phpt b/ext/pdo/tests/pdo_bindcolumn_unknown_column.phpt
new file mode 100644
index 000000000000..44e85ec07c31
--- /dev/null
+++ b/ext/pdo/tests/pdo_bindcolumn_unknown_column.phpt
@@ -0,0 +1,41 @@
+--TEST--
+PDO: bindColumn() must fail for a column name that is not in the result set
+--EXTENSIONS--
+pdo
+--SKIPIF--
+<?php
+$dir = getenv('REDIR_TEST_DIR');
+if (false == $dir) die('skip no driver');
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+if (getenv('REDIR_TEST_DIR') === false) putenv('REDIR_TEST_DIR='.__DIR__ . '/../../pdo/tests/');
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+
+$db = PDOTest::factory();
+$db->exec('CREATE TABLE pdo_bindcolumn_unknown_column (name varchar(255))');
+
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_SILENT);
+$stmt = $db->query('SELECT name FROM pdo_bindcolumn_unknown_column');
+var_dump(@$stmt->bindColumn('nosuchcolumn', $var));
+
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+try {
+    $stmt->bindColumn('nosuchcolumn', $var);
+} catch (PDOException $e) {
+    echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+?>
+--CLEAN--
+<?php
+if (getenv('PDOTEST_DSN') === 'sqlite::memory:') return;
+
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+$db = PDOTest::factory();
+$db->exec('DROP TABLE pdo_bindcolumn_unknown_column');
+?>
+--EXPECT--
+bool(false)
+PDOException: SQLSTATE[HY000]: General error: Did not find column name 'nosuchcolumn' in the defined columns; it will not be bound