Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix SQL query quoting/casting when type is passed to where function #936

Merged
merged 1 commit into from
Jun 4, 2020
Merged

Fix SQL query quoting/casting when type is passed to where function #936

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 3 additions & 3 deletions lib/Magento/Db/Adapter/Pdo/Mysql.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,9 +124,9 @@ protected function _quote($value)
* If an array is passed as the value, the array values are quote
* and then returned as a comma-separated string.
*
* @param mixed $value The value to quote.
* @param null $type OPTIONAL the SQL datatype name, or constant, or null.
* @return mixed|string An SQL-safe quoted value (or string of separated values).
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @return string An SQL-safe quoted value (or string of separated values).
*/
public function quote($value, $type = null)
{
Expand Down
10 changes: 5 additions & 5 deletions lib/Varien/Db/Adapter/Interface.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,9 +566,9 @@ public function fetchOne($sql, $bind = array());
* If an array is passed as the value, the array values are quoted
* and then returned as a comma-separated string.
*
* @param mixed $value The value to quote.
* @param mixed $type OPTIONAL the SQL datatype name, or constant, or null.
* @return mixed An SQL-safe quoted value (or string of separated values).
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @return string An SQL-safe quoted value (or string of separated values).
*/
public function quote($value, $type = null);

Expand All @@ -586,8 +586,8 @@ public function quote($value, $type = null);
* </code>
*
* @param string $text The text with a placeholder.
* @param mixed $value The value to quote.
* @param string $type OPTIONAL SQL datatype
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @param integer $count OPTIONAL count of placeholders to replace
* @return string An SQL-safe quoted value placed into the original text.
*/
Expand Down
4 changes: 2 additions & 2 deletions lib/Varien/Db/Adapter/Pdo/Mysql.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1506,8 +1506,8 @@ protected function _debugWriteToFile($str)
* Method revrited for handle empty arrays in value param
*
* @param string $text The text with a placeholder.
* @param mixed $value The value to quote.
* @param string $type OPTIONAL SQL datatype
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @param integer $count OPTIONAL count of placeholders to replace
* @return string An SQL-safe quoted value placed into the orignal text.
*/
Expand Down
9 changes: 5 additions & 4 deletions lib/Varien/Db/Select.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,8 @@ public function __construct(Zend_Db_Adapter_Abstract $adapter)
* </code>
*
* @param string $cond The WHERE condition.
* @param string $value OPTIONAL A single value to quote into the condition.
* @param null|string $type OPTIONAL The type of the given value
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @return Varien_Db_Select This Zend_Db_Select object.
*/
public function where($cond, $value = null, $type = null)
Expand All @@ -112,12 +112,13 @@ public function where($cond, $value = null, $type = null)
}
/**
* Additional internal type used for really null value
* cast to string, to prevent false matching 0 == "TYPE_CONDITION"
*/
if ($type == self::TYPE_CONDITION) {
if ((string)$type === self::TYPE_CONDITION) {
$type = null;
}
if (is_array($value)) {
$cond = $this->_adapter->quoteInto($cond, $value);
$cond = $this->_adapter->quoteInto($cond, $value, $type);
$value = null;
}
return parent::where($cond, $value, $type);
Expand Down
10 changes: 5 additions & 5 deletions lib/Zend/Db/Adapter/Abstract.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -852,9 +852,9 @@ protected function _quote($value)
* If an array is passed as the value, the array values are quoted
* and then returned as a comma-separated string.
*
* @param mixed $value The value to quote.
* @param mixed $type OPTIONAL the SQL datatype name, or constant, or null.
* @return mixed An SQL-safe quoted value (or string of separated values).
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @return string An SQL-safe quoted value (or string of separated values).
*/
public function quote($value, $type = null)
{
Expand Down Expand Up @@ -920,8 +920,8 @@ public function quote($value, $type = null)
* </code>
*
* @param string $text The text with a placeholder.
* @param mixed $value The value to quote.
* @param string $type OPTIONAL SQL datatype
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL A single value to quote into the condition.
* @param null|string|int $type OPTIONAL The type of the given value e.g. Zend_Db::INT_TYPE, "INT"
* @param integer $count OPTIONAL count of placeholders to replace
* @return string An SQL-safe quoted value placed into the original text.
*/
Expand Down
6 changes: 3 additions & 3 deletions lib/Zend/Db/Select.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -468,7 +468,7 @@ public function joinNatural($name, $cols = self::SQL_WILDCARD, $schema = null)
* </code>
*
* @param string $cond The WHERE condition.
* @param mixed $value OPTIONAL The value to quote into the condition.
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL The value to quote into the condition.
* @param int $type OPTIONAL The type of the given value
* @return Zend_Db_Select This Zend_Db_Select object.
*/
Expand All @@ -485,7 +485,7 @@ public function where($cond, $value = null, $type = null)
* Otherwise identical to where().
*
* @param string $cond The WHERE condition.
* @param mixed $value OPTIONAL The value to quote into the condition.
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value OPTIONAL The value to quote into the condition.
* @param int $type OPTIONAL The type of the given value
* @return Zend_Db_Select This Zend_Db_Select object.
*
Expand Down Expand Up @@ -991,7 +991,7 @@ protected function _tableCols($correlationName, $cols, $afterCorrelationName = n
* Internal function for creating the where clause
*
* @param string $condition
* @param mixed $value optional
* @param Zend_Db_Select|Zend_Db_Expr|array|null|int|string|float $value optional
* @param string $type optional
* @param boolean $bool true = AND, false = OR
* @return string clause
Expand Down