Added

• The drivers can now be installed with PIE (the PHP Installer for Extensions), the official replacement for the now-deprecated PECL: pie install microsoft/sqlsrv and pie install microsoft/pdo_sqlsrv.

Security

• Fixed SQL injection in PDO::lastInsertId($name) (CWE-89). The sequence-name lookup in pdo_sqlsrv_dbh_last_id previously interpolated the caller-supplied $name directly into the query text with snprintf (WHERE name=N'%s'), allowing a crafted name to break out of the string literal and inject arbitrary Transact-SQL. The name is now passed to a parameterized query (WHERE name=?) and bound with the connection encoding, so it is always treated as a literal value. This also fixes lookups for sequence names containing non-ASCII characters (#1673).
• Fixed silent truncation of binary parameters containing embedded NUL (0x00) bytes when using PDO emulated prepares with PDO::SQLSRV_ENCODING_BINARY (CWE-626). The hex-encoding loops in pdo_sqlsrv_dbh_quote treated binary data as a C string and stopped at the first NUL, causing only the pre-NUL prefix to be sent to the server. All bytes are now encoded (#1675).

Fixed

• Fixed a Windows thread-safe (ZTS) shared build link failure (unresolved external symbol LNK2001 on _tsrm_ls_cache) when building the extensions as shared DLLs (#1674).
• Fixed stale unixODBC INI caching on Linux and macOS by clearing the unixODBC INI cache at module shutdown (#1667).
• Fixed an AddressSanitizer One Definition Rule (ODR) violation reported when both the sqlsrv and pdo_sqlsrv extensions are loaded together (#1659).
• Addressed CodeQL static-analysis findings (#1615).

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• Using PIE (recommended, replaces PECL):
  pie install microsoft/sqlsrv
  pie install microsoft/pdo_sqlsrv
• Using PECL (deprecated):
  sudo pecl install sqlsrv-5.13.2
  sudo pecl install pdo_sqlsrv-5.13.2
• Windows DLLs can be found in Assets

Fixed

• Fixed access token identity leaking across pooled connections — connections with different tokens could share the same pool entry, causing identity cross-contamination and use-after-free (PR #1592)
• Fixed prepared statement silently failing on insert when triggers or SET NOCOUNT OFF produce extra result sets, causing implicit transaction rollback with MARS enabled (PR #1590)
• Fixed fatal error when re-executing a prepared statement that returns multiple result sets with different column layouts (PR #1596)
• Fixed sqlsrv_errors() returning null after a failed connection when ODBC provides no diagnostic records (PR #1595)
• Fixed binary stream becoming invalid when the originating statement goes out of scope (PR #1598)

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.13.1
sudo pecl install pdo_sqlsrv-5.13.1
• Windows DLLs can be found in Assets

(Republished on the correct commit)

Added

• Support for PHP 8.4 and PHP 8.5
• Support for Windows Server 2025
• Support for Ubuntu 24.04
• Support for Debian 11, 12, and 13
• Support for Red Hat 9 and 10
• Support for Alpine 3.20, 3.21, 3.22, and 3.23
• Support for macOS 15 and 26

Removed

• Support for PHP 8.1 and 8.2
• Support for Windows 10, Server 2012, and Server 2012 R2
• Support for Ubuntu 20.04
• Support for Debian 10
• Support for Red Hat 7
• Support for SUSE Linux 12
• Support for Alpine 3.16, 3.17, 3.18, and 3.19
• Support for macOS 11, 12, and 13

Changed

• Refactored build scripts for safety, error handling, and command injection prevention (PR #1551, PR #1552)

Fixed

• Fixed segfault when connecting to Fabric (PR #1549)
• Enhanced error reporting in PDO driver when ODBC diagnostic retrieval fails (PR #1549)
• Fixed critical memory safety bugs in encoding conversion - NULL pointer dereference and uninitialized pointer return (PR #1555)
• Removed lingering error2 reference from failure block in CI pipeline (PR #1568)
• Fixed PHP 8.5 compatibility issues in tests and CI pipeline (PR #1569)

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.13.0
sudo pecl install pdo_sqlsrv-5.13.0
• Windows DLLs can be found in Assets

(Republished on the correct commit)

Added

• Support for PHP 8.4
• Support for Windows Server 2025
• Support for Ubuntu 24.04
• Support for Debian 12 and 13
• Support for Red Hat 9
• Support for Alpine 3.21, 3.22, and 3.23
• Support for macOS 14, 15, and 26

Removed

• Support for PHP 8.1
• Support for Windows 10, Server 2012, and Server 2012 R2
• Support for Ubuntu 20.04
• Support for Debian 10
• Support for macOS 11 and 12

Fixed

• Fixed segfault when connecting to Fabric (PR #1549)
• Enhanced error reporting in PDO driver when ODBC diagnostic retrieval fails (PR #1549)

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.13.0beta1
sudo pecl install pdo_sqlsrv-5.13.0beta1
• Windows DLLs can be found in Assets

Added

-Support for PHP 8.3
-Support for Alpine 3.19

Removed

-Support for PHP 8.0
-Support for Ubuntu 18.04
-Support for Alpine 3.15

Fixed

-Update connection string keywords set function (#1484)
-Fix error throw for multiple result sets (#1485)
-Fix invalid precision error (#1497)

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• This release requires ODBC Driver 17.4.2 or above. Otherwise, a warning about failing to set an attribute may be suppressed when using an older ODBC driver.
• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.12.0
sudo pecl install pdo_sqlsrv-5.12.0
• Windows DLLs can be found in Assets

Added

• Support for PHP 8.3

Removed

• Support for PHP 8.0
• Support for Ubuntu 18.04

Fixed

• Update connection string keywords set function (#1484)
• Fix error throw for multiple result sets (#1485)

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• This release requires ODBC Driver 17.4.2 or above. Otherwise, a warning about failing to set an attribute may be suppressed when using an older ODBC driver.
• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.12.0beta1
sudo pecl install pdo_sqlsrv-5.12.0beta1
• Windows DLLs can be found in Assets

Fixed

• Reset type after bind param (#1452)
• Fixed error when using PDO::ATTR_STRINGIFY_FETCHES (#1468) by SakiTakamachi
• Change connection options to case insensitive (#1460)
• Bugfix for 1465 Adding a NULL check (#1471)

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• This release requires ODBC Driver 17.4.2 or above. Otherwise, a warning about failing to set an attribute may be suppressed when using an older ODBC driver.
• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.11.1
sudo pecl install pdo_sqlsrv-5.11.1
• Windows DLLs can be found in Assets

Added

• Support for PHP 8.2

Removed

• Support for PHP 7.4

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• This release requires ODBC Driver 17.4.2 or above. Otherwise, a warning about failing to set an attribute may be suppressed when using an older ODBC driver.
• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.11.0
sudo pecl install pdo_sqlsrv-5.11.0
• Windows DLLs can be found in Assets

Added

• Support for PHP 8.2

Fixed

• Pull request #1408 - Fixed right truncation issue, unit test added by talkinnl

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• This release requires ODBC Driver 17.4.2 or above. Otherwise, a warning about failing to set an attribute may be suppressed when using an older ODBC driver.
• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:
Click here to start the PHP survey

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.11.0beta1
sudo pecl install pdo_sqlsrv-5.11.0beta1
• Windows DLLs can be found in Assets

Added

• Pull request #1382 - Support for ActiveDirectoryIntegrated authentication

Fixed

• Pull request #1374 - Fixed ActiveDirectoryMsi Authentication behavior when specified UID by laclefyoshi

Limitations

• No support for inout / output params when using sql_variant type
• No support for inout / output params when formatting decimal values
• In Linux and macOS, setlocale() only takes effect if it is invoked before the first connection. Attempting to set the locale after connecting will not work
• Always Encrypted requires MS ODBC Driver 17+
  • Only Windows Certificate Store and Azure Key Vault are supported. Custom Keystores are not yet supported
  • Issue #716 - With Always Encrypted enabled, named parameters in subqueries are not supported
  • Issue #1050 - With Always Encrypted enabled, insertion requires the column list for any tables with identity columns
  • Always Encrypted limitations

Known Issues

• This release requires ODBC Driver 17.4.2 or above. Otherwise, a warning about failing to set an attribute may be suppressed when using an older ODBC driver.
• Connection pooling on Linux or macOS is not recommended with unixODBC < 2.3.7
• When pooling is enabled in Linux or macOS
  • unixODBC <= 2.3.4 (Linux and macOS) might not return proper diagnostic information, such as error messages, warnings and informative messages
  • due to this unixODBC bug, fetch large data (such as xml, binary) as streams as a workaround. See the examples here

Survey

Let us know how we are doing and how you use our drivers by taking our pulse survey:

Install

• On Linux and macOS run the commands below:
  sudo pecl install sqlsrv-5.10.1
sudo pecl install pdo_sqlsrv-5.10.1
• To download Windows DLLs for PHP 7.4 or above from the PECL repository, please navigate to SQLSRV or PDO_SQLSRV.