microsoft · Jahnvi Thakkar (jahnvi480) · Sep 15, 2026 · Sep 11, 2026 · Sep 12, 2026 · Sep 14, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,14 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/)
 
 ## [Unreleased]
 
+### Added
+- Connection option aliases `ConnectTimeout` for `LoginTimeout`, `FailoverPartner` for `Failover_Partner`, and `WorkstationID` for `WSID` in both drivers. Existing ODBC keywords and attributes are retained for compatibility with older supported ODBC drivers. Names are case-insensitive, and the last occurrence of an option or its alias wins.
+- The `Password` alias for `PWD` in SQLSRV connection options, and `PWD`/`Password` in PDO_SQLSRV DSNs. A non-null PDO constructor password takes precedence (including an empty string); otherwise the DSN password is used. The username still comes from the PDO constructor. Password aliases retain existing authentication restrictions and brace-escaping rules. Prefer constructor credentials when a DSN might be logged or shared.
+
+### Fixed
+- Bounded connection-option brace validation to the supplied value length, avoiding reads past the terminator of brace-quoted values.
+- Securely erase driver-owned PDO DSN password copies before releasing or replacing them, including parser errors and connection failures. Original PDO/caller-owned strings and exception trace behavior are unchanged.
+
 ## 5.13.3 - 2026-08-07
 Updated PECL release packages. Here is the list of updates:
 

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
@@ -6,7 +6,8 @@ variables:
   host: 'sql1'
   sqlsrv_db: 'sqlsrv_testdb'
   pdo_sqlsrv_db: 'pdo_sqlsrv_testdb'
-  uid: 'sa'
+  # Azure uppercases environment variable names; UID would shadow Bash's user ID.
+  sqlUser: 'sa'
 
 trigger:
 - dev
@@ -104,23 +105,24 @@ jobs:
       set -e
       echo "Installing Microsoft ODBC Driver 18 for SQL Server..."
 
-      brew tap microsoft/mssql-release https://github.com/Microsoft/homebrew-mssql-release
-      # Homebrew now requires explicit trust for third-party taps/formulae in CI.
+      # Tapping evaluates formulae, so trust this specific tap before adding it.
       if brew help trust >/dev/null 2>&1; then
-        brew trust microsoft/mssql-release || \
-        brew trust --formula microsoft/mssql-release/msodbcsql18
+        brew trust --tap microsoft/mssql-release
       fi
-      HOMEBREW_ACCEPT_EULA=Y brew install msodbcsql18 mssql-tools18
+      brew tap microsoft/mssql-release https://github.com/Microsoft/homebrew-mssql-release
+      HOMEBREW_ACCEPT_EULA=Y brew install \
+        microsoft/mssql-release/msodbcsql18 \
+        microsoft/mssql-release/mssql-tools18
 
       # Verify installation
-      if [[ $(brew list --verbose msodbcsql18) ]]; then
+      if driver_files=$(brew list --verbose msodbcsql18) && [[ -n "$driver_files" ]]; then
          echo "ODBC driver is installed successfully"
       else
          echo "ODBC driver did not install properly"
          exit 1
       fi
 
-      if [[ $(brew list --verbose mssql-tools18) ]]; then
+      if tool_files=$(brew list --verbose mssql-tools18) && [[ -n "$tool_files" ]]; then
          echo "TOOLS installed successfully"
       else
          echo "TOOLS did not install properly"
@@ -145,10 +147,10 @@ jobs:
 
       # Try to connect
       /opt/homebrew/opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 \
-        -U $(uid) -P "$(macpwd)" -No -C \
+        -U $(sqlUser) -P "$(macpwd)" -No -C \
         -Q "SELECT @@Version" || \
       /usr/local/opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 \
-        -U $(uid) -P "$(macpwd)" -No -C \
+        -U $(sqlUser) -P "$(macpwd)" -No -C \
         -Q "SELECT @@Version"
 
       echo "SQL Server connection verified!"
@@ -271,7 +273,7 @@ jobs:
       set -e
       cd $(REPO_ROOT)/test/functional/setup
       export TEST_PHP_SQL_SERVER='127.0.0.1'
-      export TEST_PHP_SQL_UID='$(uid)'
+      export TEST_PHP_SQL_UID='$(sqlUser)'
       export TEST_PHP_SQL_PWD='$(macpwd)'
 
       # Add sqlcmd and bcp tools to PATH
@@ -294,7 +296,7 @@ jobs:
       cd $(REPO_ROOT)/test/functional
 
       SQL_SERVER="127.0.0.1"
-      SQL_USER="$(uid)"
+      SQL_USER="$(sqlUser)"
       SQL_PWD="$(macpwd)"
       SRV_DB="$(macOS_sqlsrv_db)"
       PDO_DB="$(macOS_pdo_sqlsrv_db)"
@@ -356,19 +358,19 @@ jobs:
 
       # Connection environment variables
       export MSSQL_SERVER='127.0.0.1'
-      export MSSQL_USER='$(uid)'
+      export MSSQL_USER='$(sqlUser)'
       export MSSQL_PASSWORD='$(macpwd)'
       export MSSQL_DATABASE_NAME='$(macOS_sqlsrv_db)'
       export MSSQL_DRIVER_NAME='ODBC Driver 18 for SQL Server'
       export TEST_PHP_SQL_SERVER='127.0.0.1'
-      export TEST_PHP_SQL_UID='$(uid)'
+      export TEST_PHP_SQL_UID='$(sqlUser)'
       export TEST_PHP_SQL_PWD='$(macpwd)'
 
       # Verify connection before running tests
       echo "Verifying database connection before tests..."
       $PHP_BIN -c $PHP_INI -r "
       \$server = '127.0.0.1';
-      \$options = array('Database' => '$(macOS_sqlsrv_db)', 'UID' => '$(uid)', 'PWD' => '$(macpwd)', 'Encrypt' => 'no');
+      \$options = array('Database' => '$(macOS_sqlsrv_db)', 'UID' => '$(sqlUser)', 'PWD' => '$(macpwd)', 'Encrypt' => 'no');
       \$conn = sqlsrv_connect(\$server, \$options);
       if (\$conn === false) {
           print_r(sqlsrv_errors());
@@ -493,7 +495,7 @@ jobs:
 
   - script: |
       export TEST_PHP_SQL_SERVER='127.0.0.1'
-      export TEST_PHP_SQL_UID='$(uid)'
+      export TEST_PHP_SQL_UID='$(sqlUser)'
       export TEST_PHP_SQL_PWD='$(macpwd)'
 
       echo "Dropping test databases..."
@@ -591,7 +593,7 @@ jobs:
       sleep 10
 
       # Verify SQL Server is running
-      docker exec -t $(host) /opt/mssql-tools18/bin/sqlcmd -S $(server) -C -U $(uid) -P $(pwd) -Q 'SELECT @@VERSION'
+      docker exec -t $(host) /opt/mssql-tools18/bin/sqlcmd -S $(server) -C -U $(sqlUser) -P $(pwd) -Q 'SELECT @@VERSION'
     displayName: 'Run SQL Server for Linux'
 
   - script: |
@@ -621,7 +623,7 @@ jobs:
   - script: |
       echo "Setting up test databases..."
       export TEST_PHP_SQL_SERVER='$(server)'
-      export TEST_PHP_SQL_UID='$(uid)'
+      export TEST_PHP_SQL_UID='$(sqlUser)'
       export TEST_PHP_SQL_PWD='$(pwd)'
 
       cd $(Build.SourcesDirectory)/test/functional/setup
@@ -662,18 +664,30 @@ jobs:
       php --ri pdo_sqlsrv
     displayName: 'Build and install drivers'
 
+  - script: |
+      set -e
+      bash "$(Build.SourcesDirectory)/test/tools/test_pdo_password_cleanup.sh"
+    displayName: 'Verify native PDO password erasure'
+    env:
+      MSSQL_SERVER: $(server)
+      MSSQL_USER: $(sqlUser)
+      MSSQL_PASSWORD: $(pwd)
+      MSSQL_DRIVER_NAME: 'ODBC Driver 18 for SQL Server'
+      LANG: 'en_US.UTF-8'
+      LC_ALL: 'en_US.UTF-8'
+
   - script: |
       echo "Updating MsSetup.inc files..."
       cd $(Build.SourcesDirectory)/test/functional/sqlsrv
       sed -i -e 's/TARGET_SERVER/'"$(server)"'/g' MsSetup.inc
       sed -i -e 's/TARGET_DATABASE/'"$(sqlsrv_db)"'/g' MsSetup.inc
-      sed -i -e 's/TARGET_USERNAME/'"$(uid)"'/g' MsSetup.inc
+      sed -i -e 's/TARGET_USERNAME/'"$(sqlUser)"'/g' MsSetup.inc
       sed -i -e 's/TARGET_PASSWORD/'"$(pwd)"'/g' MsSetup.inc
 
       cd $(Build.SourcesDirectory)/test/functional/pdo_sqlsrv
       sed -i -e 's/TARGET_SERVER/'"$(server)"'/g' MsSetup.inc
       sed -i -e 's/TARGET_DATABASE/'"$(pdo_sqlsrv_db)"'/g' MsSetup.inc
-      sed -i -e 's/TARGET_USERNAME/'"$(uid)"'/g' MsSetup.inc
+      sed -i -e 's/TARGET_USERNAME/'"$(sqlUser)"'/g' MsSetup.inc
       sed -i -e 's/TARGET_PASSWORD/'"$(pwd)"'/g' MsSetup.inc
 
       echo "MsSetup.inc files updated"
@@ -682,7 +696,7 @@ jobs:
   - script: |
       cd $(Build.SourcesDirectory)/test/functional/sqlsrv
       export MSSQL_SERVER='$(server)'
-      export MSSQL_USER='$(uid)'
+      export MSSQL_USER='$(sqlUser)'
       export MSSQL_PASSWORD='$(pwd)'
       export MSSQL_DATABASE_NAME='$(sqlsrv_db)'
       export MSSQL_DRIVER_NAME='ODBC Driver 18 for SQL Server'
@@ -694,7 +708,7 @@ jobs:
   - script: |
       cd $(Build.SourcesDirectory)/test/functional/pdo_sqlsrv
       export MSSQL_SERVER='$(server)'
-      export MSSQL_USER='$(uid)'
+      export MSSQL_USER='$(sqlUser)'
       export MSSQL_PASSWORD='$(pwd)'
       export MSSQL_DATABASE_NAME='$(pdo_sqlsrv_db)'
       export MSSQL_DRIVER_NAME='ODBC Driver 18 for SQL Server'
@@ -861,7 +875,7 @@ jobs:
 
       # Test connection with SQL Auth using named pipe
       Write-Host "Testing connection to LocalDB with SQL Authentication..."
-      sqlcmd -S "(localdb)\MSSQLLocalDB" -U $(uid) -P "$(pwd)" -Q "SELECT @@VERSION"
+      sqlcmd -S "(localdb)\MSSQLLocalDB" -U $(sqlUser) -P "$(pwd)" -Q "SELECT @@VERSION"
 
       Write-Host "SQL Server LocalDB is ready"
     displayName: 'Start SQL Server LocalDB'
@@ -874,7 +888,7 @@ jobs:
       (Get-Content .\MsSetup.inc) | ForEach-Object { 
           $_ -replace "TARGET_SERVER", $server `
              -replace "TARGET_DATABASE", "$(sqlsrv_db)" `
-             -replace "TARGET_USERNAME", "$(uid)" `
+             -replace "TARGET_USERNAME", "$(sqlUser)" `
              -replace "TARGET_PASSWORD", "$(pwd)" 
       } | Set-Content .\MsSetup.inc
 
@@ -885,7 +899,7 @@ jobs:
       (Get-Content .\MsSetup.inc) | ForEach-Object { 
           $_ -replace "TARGET_SERVER", $server `
              -replace "TARGET_DATABASE", "$(pdo_sqlsrv_db)" `
-             -replace "TARGET_USERNAME", "$(uid)" `
+             -replace "TARGET_USERNAME", "$(sqlUser)" `
              -replace "TARGET_PASSWORD", "$(pwd)" 
       } | Set-Content .\MsSetup.inc
 
@@ -896,15 +910,15 @@ jobs:
       (Get-Content .\connect.inc) | ForEach-Object { 
           $_ -replace '(\$server = )[^;]+;', "`$1'$server';" `
              -replace '(\$databaseName = )[^;]+;', "`$1'$(sqlsrv_db)';" `
-             -replace '(\$uid = )[^;]+;', "`$1'$(uid)';" `
+             -replace '(\$uid = )[^;]+;', "`$1'$(sqlUser)';" `
              -replace '(\$pwd = )[^;]+;', "`$1'$(pwd)';" 
       } | Set-Content .\connect.inc
 
       cd $(Build.SourcesDirectory)\test\bvt\pdo_sqlsrv
       (Get-Content .\connect.inc) | ForEach-Object { 
           $_ -replace '(\$server = )[^;]+;', "`$1'$server';" `
              -replace '(\$databaseName = )[^;]+;', "`$1'$(pdo_sqlsrv_db)';" `
-             -replace '(\$uid = )[^;]+;', "`$1'$(uid)';" `
+             -replace '(\$uid = )[^;]+;', "`$1'$(sqlUser)';" `
              -replace '(\$pwd = )[^;]+;', "`$1'$(pwd)';" 
       } | Set-Content .\connect.inc
     displayName: 'Update connection credentials'
@@ -984,7 +998,7 @@ jobs:
 
       # Set environment variables for the Python script
       $env:TEST_PHP_SQL_SERVER = "(localdb)\MSSQLLocalDB"
-      $env:TEST_PHP_SQL_UID = "$(uid)"
+      $env:TEST_PHP_SQL_UID = "$(sqlUser)"
       $env:TEST_PHP_SQL_PWD = "$(pwd)"
 
       cd $(Build.SourcesDirectory)\test\functional\setup
@@ -1010,7 +1024,7 @@ jobs:
       set PATH=C:\Program Files\OpenCppCoverage;%PATH%
       cd $(Build.SourcesDirectory)\test\functional\sqlsrv
       set MSSQL_SERVER=(localdb)\MSSQLLocalDB
-      set MSSQL_USER=$(uid)
+      set MSSQL_USER=$(sqlUser)
       set MSSQL_PASSWORD=$(pwd)
       set MSSQL_DATABASE_NAME=$(sqlsrv_db)
       OpenCppCoverage --sources $(Build.SourcesDirectory)\buildscripts --modules php_sqlsrv.dll --cover_children --export_type cobertura:$(Build.SourcesDirectory)\coverage-sqlsrv.xml -- php run-tests.php *.phpt --no-color --show-diff 2>&1 | tee ..\sqlsrv.log
@@ -1020,7 +1034,7 @@ jobs:
       set PATH=C:\Program Files\OpenCppCoverage;%PATH%
       cd $(Build.SourcesDirectory)\test\functional\pdo_sqlsrv
       set MSSQL_SERVER=(localdb)\MSSQLLocalDB
-      set MSSQL_USER=$(uid)
+      set MSSQL_USER=$(sqlUser)
       set MSSQL_PASSWORD=$(pwd)
       set MSSQL_DATABASE_NAME=$(pdo_sqlsrv_db)
       OpenCppCoverage --sources $(Build.SourcesDirectory)\buildscripts --modules php_pdo_sqlsrv.dll --cover_children --export_type cobertura:$(Build.SourcesDirectory)\coverage-pdo_sqlsrv.xml -- php run-tests.php *.phpt --no-color --show-diff 2>&1 | tee ..\pdo_sqlsrv.log