Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong escaping in mysqli adapter #296

Closed
Exceptionfault opened this issue Aug 25, 2011 · 2 comments
Closed

Wrong escaping in mysqli adapter #296

Exceptionfault opened this issue Aug 25, 2011 · 2 comments

Comments

@Exceptionfault
Copy link

When using the mysqli adapter and the following database select:

return $this->db->select("a.x, a.y, COALESCE(a.z, 0) as z')
                ->from('a')->join("b", "left")->order_by('a.sortorder')
                ->get()->result();

The resulting SQL Statement will look like this:

SELECT `a`.`x`, `a`.`y`, COALESCE(a.z, `0)` as z  [snip]

See the wrong order of ) and ' in the COALESCE function. When I add a whitespace in the method call like this:

COALESCE(a.z, 0        ) 

then the generated sql is correct.

SELECT `a`.`x`, `a`.`y`, COALESCE(a.z, `0`) as z  [snip]
@Exceptionfault
Copy link
Author

I've notived even onother bad thing...

$this->db->select("COALESCE(price * amount, 0.0 )");

results in

SELECT COALESCE(price * amount, `0`.`0` ) 

@ktomk
Copy link
Contributor

ktomk commented Aug 29, 2011

That's because some string search and replace is in action rather than parsing the SQL. It's document that CI only tries:

$this->db->select() accepts an optional second parameter. If you set it to FALSE, CodeIgniter will not try to protect your field or table names with backticks. This is useful if you need a compound select statement. [Highlight added]

Use $this->db->select("COALESCE(price * amount, 0.0 )", FALSE); instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants