Skip to content

Commit 00b9a4e

Browse files
committed
SqlPreprocessor: backtick identifiers are skipped when looking for placeholders [Closes #318]
1 parent f48cfb5 commit 00b9a4e

2 files changed

Lines changed: 13 additions & 1 deletion

File tree

‎src/Database/SqlPreprocessor.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ public function process(array $params, bool $useParams = false): array
9999
~
100100
'[^']*+'
101101
|"[^"]*+"
102+
|`[^`]*+`
102103
|\?[a-z]*
103104
|^\s*+(?:\(?\s*SELECT|INSERT|UPDATE|DELETE|REPLACE|EXPLAIN)\b
104105
|\b(?:SET|WHERE|HAVING|ORDER\ BY|GROUP\ BY|KEY\ UPDATE)(?=\s*$|\s*\?)
@@ -126,7 +127,7 @@ public function process(array $params, bool $useParams = false): array
126127
private function parsePart(array $match): string
127128
{
128129
$match = $match[0];
129-
if (in_array($match[0], ["'", '"', '/', '-'], true)) { // string or comment
130+
if (in_array($match[0], ["'", '"', '`', '/', '-'], true)) { // string, identifier or comment
130131
return $match;
131132

132133
} elseif (!str_contains($match, '?')) { // command

‎tests/Database/SqlPreprocessor.phpt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,17 @@ test('Preserves string literals containing question marks', function () use ($pr
134134
});
135135

136136

137+
test('Preserves backtick identifiers containing question marks or comment marks', function () use ($preprocessor) {
138+
[$sql, $params] = $preprocessor->process(['SELECT `a?`.id FROM author AS `a?` WHERE id = ?', 11]);
139+
Assert::same('SELECT `a?`.id FROM author AS `a?` WHERE id = ?', $sql);
140+
Assert::same([11], $params);
141+
142+
[$sql, $params] = $preprocessor->process(['SELECT `a--b`.id FROM author AS `a--b` WHERE id > ? AND id < ?', 11, 12]);
143+
Assert::same('SELECT `a--b`.id FROM author AS `a--b` WHERE id > ? AND id < ?', $sql);
144+
Assert::same([11, 12], $params);
145+
});
146+
147+
137148
test('Auto-detects operator in WHERE conditions', function () use ($preprocessor) {
138149
[$sql, $params] = $preprocessor->process(['SELECT id FROM tbl WHERE', [
139150
'col_null' => null,

0 commit comments

Comments
 (0)