Merge pull request #516 from MauricioFauth/limit-param

Fix bind parameter in LIMIT OFFSET
phpmyadmin · Sep 27, 2023 · 4e288e8 · 4e288e8
2 parents 24d734a + 6621941
commit 4e288e8
Show file tree

Hide file tree

Showing 5 changed files with 417 additions and 8 deletions.
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
@@ -271,12 +271,12 @@ parameters:
 			path: src/Components/Key.php
 
 		-
-			message: "#^Property PhpMyAdmin\\\\SqlParser\\\\Components\\\\Limit\\:\\:\\$offset \\(int\\) does not accept mixed\\.$#"
+			message: "#^Property PhpMyAdmin\\\\SqlParser\\\\Components\\\\Limit\\:\\:\\$offset \\(int\\|string\\) does not accept mixed\\.$#"
 			count: 1
 			path: src/Components/Limit.php
 
 		-
-			message: "#^Property PhpMyAdmin\\\\SqlParser\\\\Components\\\\Limit\\:\\:\\$rowCount \\(int\\) does not accept mixed\\.$#"
+			message: "#^Property PhpMyAdmin\\\\SqlParser\\\\Components\\\\Limit\\:\\:\\$rowCount \\(int\\|string\\) does not accept mixed\\.$#"
 			count: 1
 			path: src/Components/Limit.php
 

diff --git a/src/Components/Limit.php b/src/Components/Limit.php
@@ -19,20 +19,20 @@ class Limit extends Component
     /**
      * The number of rows skipped.
      *
-     * @var int
+     * @var int|string
      */
     public $offset;
 
     /**
      * The number of rows to be returned.
      *
-     * @var int
+     * @var int|string
      */
     public $rowCount;
 
     /**
-     * @param int $rowCount the row count
-     * @param int $offset   the offset
+     * @param int|string $rowCount the row count
+     * @param int|string $offset   the offset
      */
     public function __construct($rowCount = 0, $offset = 0)
     {
@@ -88,8 +88,11 @@ public static function parse(Parser $parser, TokensList $list, array $options =
                 continue;
             }
 
-            // Skip if not a number
-            if (($token->type !== Token::TYPE_NUMBER)) {
+            // Skip if not a number or a bind parameter (?)
+            if (
+                ! ($token->type === Token::TYPE_NUMBER
+                    || ($token->type === Token::TYPE_SYMBOL && ($token->flags & Token::FLAG_SYMBOL_PARAMETER)))
+            ) {
                 break;
             }
 

diff --git a/tests/Misc/BugsTest.php b/tests/Misc/BugsTest.php
@@ -35,6 +35,7 @@ public function bugProvider(): array
             ['bugs/gh412'],
             ['bugs/gh478'],
             ['bugs/gh492'],
+            ['bugs/gh498'],
             ['bugs/gh499'],
             ['bugs/gh508'],
             ['bugs/gh511'],

diff --git a/tests/data/bugs/gh498.in b/tests/data/bugs/gh498.in
@@ -0,0 +1,4 @@
+SELECT ?
+FROM uno
+JOIN dos  ON dos.id = uno.id
+LIMIT ? OFFSET ?