When you're using ACL on Drupal with an Oracle backend, the following PDO exception occurs for anonymous users:

PDOException: SELECT acl_id FROM {acl_user} WHERE uid = :uid (prepared: SELECT acl_id FROM "ACL_USER" WHERE "UID" = :db_uid ) e: SQLSTATE[HY000]: General error 1036: OCIBindByName: ORA-01036: illegal variable name/number (ext\pdo_oci\oci_statement.c:310) args: Array ( [uid] => 0 ) in acl_node_grants() (line 280 of D:\wwwroot\mytc\sites\all\modules\contrib\acl\acl.module).

By changing the query at that line to use db_select instead of db_query the issue is resolved.

I have the updated query and will post it in the first comment.

Comments

minoroffense’s picture

minoroffense commented 
  $query = db_select('acl_user', 'a');
  $query->addField('a', 'acl_id');
  $query->condition('a.uid', $account->uid);
  $acl_ids = $query->execute()->fetchCol();
salvis’s picture

salvis
he/his
commented

Interesting, thank you for your post.

For reference, here's the code that fails:

/**
 * Implements hook_node_grants().
 */
function acl_node_grants($account, $op) {
  $acl_ids = db_query("SELECT acl_id FROM {acl_user} WHERE uid = :uid", array(
    'uid' => $account->uid,
  ))->fetchCol();
  return (!empty($acl_ids) ? array('acl' => $acl_ids) : NULL);
}

Does it only fail for Anon — because of [uid] => 0? And work for non-zero UIDs?

We have about 10 other db_query() calls (and a dozen more in the tests). These are supposed to be valid. Do they all fail under Oracle?

I'm not sure whether this is an ACL bug or a bug in the Oracle driver. Where is the issue queue for the Oracle driver?

minoroffense’s picture

minoroffense commented

It very well may be a bug in Oracle as well. I haven't seen any of the other queries fail yet but they may never have been called in my limited testing.

Making the change to db_select shouldn't negatively impact anything really but you're right, should look into how the oracle module is handling db_query parameters compared to db_select.

http://drupal.org/project/oracle

The error is due to the zero value. Binding parameters with databases like db2, oracle and such always have interesting quirks when dealing with 0, null and False as values.

salvis’s picture

salvis
he/his
commented
Project: ACL » Oracle Driver
Version: 7.x-1.0 » 7.x-1.x-dev

Let's go over there and ask: Is this an Oracle driver bug?

I don't think contribs should have to worry about these kinds of quirks...

brianV’s picture

brianV commented

Does this bug still occur after #1368840: Escaping of uid is not handled properly in all cases. is fixed?

bohart’s picture

bohart
Location Lutsk, Ukraine
commented
Issue summary: View changes
Status: Active » Closed (outdated)

D7 reached its EOL back in January 2025, and there is no active release for D7 for this module anymore.
Development or support is not planned for D7. All D7-related issues are marked as outdated in a bunch.

Everyone can apply the patches/suggestions above (not tested by the maintainers, tested by the community) to their D7 projects.
If the issue remains relevant for D10+ versions, merge requests with proposed solutions for a new module version (D10+) are welcome in a new follow-up issue.

Thanks!

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.