diff --git a/lib/Perl/Critic/Policy/ValuesAndExpressions/PreventSQLInjection.pm b/lib/Perl/Critic/Policy/ValuesAndExpressions/PreventSQLInjection.pm index d69e202..cd26876 100644 --- a/lib/Perl/Critic/Policy/ValuesAndExpressions/PreventSQLInjection.pm +++ b/lib/Perl/Critic/Policy/ValuesAndExpressions/PreventSQLInjection.pm @@ -593,6 +593,10 @@ sub get_complete_variable { $is_quoted = 1; last; } + elsif ($sibling->isa('PPI::Token::Word') + && $sibling->method_call() + # allow for stacking method calls, e.g. $foo->bar->baz->dbh->quote + $variable .= $sibling->content(); else { last; } diff --git a/t/ValuesAndExpressions/PreventSQLInjection.run b/t/ValuesAndExpressions/PreventSQLInjection.run index 079b016..d1bf0a9 100644 --- a/t/ValuesAndExpressions/PreventSQLInjection.run +++ b/t/ValuesAndExpressions/PreventSQLInjection.run @@ -452,6 +452,12 @@ $sql = "UPDATE table_name SET field = " . $dbh->test($value) . "WHERE field = 1" $sql = "UPDATE table_name SET field = " . $dbh->test($value) . "WHERE field = " . $dbh->quote($value2); +## name Allow stacked calls prior to quoting method +## parms { quoting_methods => 'test' } +## failures 0 +## cut + +$sql = "UPDATE table_name SET field = " . $foo->bar->baz->dbh->test($value) . "WHERE field = 1"; ## name vars in subtest name. ## parms { prefer_upper_case_keywords => 0 }