Browse Source

SqlDbDriver quote identifier - add checking for string as placeholder.

namespace
Alexander Demidov 11 years ago
parent
commit
3f6b2adefd
  1. 6
      model/SqlDbDriver.php

6
model/SqlDbDriver.php

@ -110,7 +110,9 @@ abstract class SqlDbDriver extends DbDriver
{ {
$ident = explode('.', $ident); $ident = explode('.', $ident);
foreach ($ident as &$segment) { foreach ($ident as &$segment) {
$segment = $this->identifier_quote . $segment . $this->identifier_quote;
if (!preg_match('/(\?|:[A-z0-9_]+)/u', $segment)) {
$segment = $this->identifier_quote . $segment . $this->identifier_quote;
}
} }
return implode('.', $ident); return implode('.', $ident);
} }
@ -141,7 +143,7 @@ abstract class SqlDbDriver extends DbDriver
foreach ($where as $cond => &$term) { foreach ($where as $cond => &$term) {
if (is_int($cond)) { if (is_int($cond)) {
if (is_int($term)) { if (is_int($term)) {
throw new ErrorException('Condition in where expression as integer. Dangerous. ' . $term);
throw new ErrorException('Condition in where expression as integer. ' . $term);
} }
if ($term instanceof DbExpr) { if ($term instanceof DbExpr) {
$term = (string) $term; $term = (string) $term;

Loading…
Cancel
Save