Working on issue TomFrost#15, escaping field names with backticks (`).

gibbonweb · Jun 4, 2012 · d3eacae · d3eacae
1 parent b41c2c5
commit d3eacae
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/database/formatters/StandardSQLFormatter.php b/database/formatters/StandardSQLFormatter.php
@@ -174,7 +174,7 @@ protected function parseINTO(&$clause) {
 		if (isset($clause['fields']) && $clause['fields']) {
 			$str .= ' (';
 			foreach ($clause['fields'] as $field)
-				$str .= $field . ', ';
+				$str .= '`' . $field . '`, ';
 			$str = substr($str, 0, -2) . ')';
 		}
 		return $str;
@@ -224,7 +224,7 @@ protected function parseORDERBY(&$clause) {
 		foreach ($clause as $field) {
 			if (!isset($field['field']))
 				throw new InvalidSQLException('Field not specified in ORDER BY argument.');
-			$str .= $field['field'];
+			$str .= '`' . $field['field'] . '`';
 			if (isset($field['direction']))
 				$str .= ' ' . $field['direction'];
 			$str .= ', ';
@@ -244,9 +244,9 @@ protected function parseSELECT(&$clause) {
 			foreach ($clause['fields'] as $field) {
 				if (!isset($field['field']))
 					throw new InvalidSQLException('Field name not set in SELECT statement.');
-				$str .= $field['field'];
+				$str .= '`' . $field['field'] . '`';
 				if (isset($field['alias']) && $field['alias'])
-					$str .= ' ' . $field['alias'];
+					$str .= ' `' . $field['alias'] . '`';
 				$str .= ', ';
 				if (isset($field['vars'])) {
 					foreach ($field['vars'] as $var)