Connection::quote() can only quote strings

parent 94b6980f
# Upgrade to 3.0 # Upgrade to 3.0
## BC BREAK `Statement::quote()` only accepts strings.
`Statement::quote()` and `ExpressionBuilder::literal()` no longer accept arguments of an arbitrary type and and don't implement type-specific handling. Only strings can be quoted.
## BC BREAK `Statement` and `Connection` methods return `void`. ## BC BREAK `Statement` and `Connection` methods return `void`.
`Connection::connect()`, `Statement::bindParam()`, `::bindValue()`, `::execute()`, `ResultStatement::setFetchMode()` and `::closeCursor()` no longer return a boolean value. They will throw an exception in case of failure. `Connection::connect()`, `Statement::bindParam()`, `::bindValue()`, `::execute()`, `ResultStatement::setFetchMode()` and `::closeCursor()` no longer return a boolean value. They will throw an exception in case of failure.
......
...@@ -817,13 +817,9 @@ class Connection implements DriverConnection ...@@ -817,13 +817,9 @@ class Connection implements DriverConnection
/** /**
* {@inheritDoc} * {@inheritDoc}
*/ */
public function quote($input, $type = null) public function quote(string $input) : string
{ {
$connection = $this->getWrappedConnection(); return $this->getWrappedConnection()->quote($input);
[$value, $bindingType] = $this->getBindingInfo($input, $type);
return $connection->quote($value, $bindingType);
} }
/** /**
......
...@@ -3,7 +3,6 @@ ...@@ -3,7 +3,6 @@
namespace Doctrine\DBAL\Driver; namespace Doctrine\DBAL\Driver;
use Doctrine\DBAL\DBALException; use Doctrine\DBAL\DBALException;
use Doctrine\DBAL\ParameterType;
/** /**
* Connection interface. * Connection interface.
...@@ -27,13 +26,8 @@ interface Connection ...@@ -27,13 +26,8 @@ interface Connection
/** /**
* Quotes a string for use in a query. * Quotes a string for use in a query.
*
* @param mixed $input
* @param int $type
*
* @return mixed
*/ */
public function quote($input, $type = ParameterType::STRING); public function quote(string $input) : string;
/** /**
* Executes an SQL statement and return the number of affected rows. * Executes an SQL statement and return the number of affected rows.
......
...@@ -6,7 +6,6 @@ use Doctrine\DBAL\Driver\Connection; ...@@ -6,7 +6,6 @@ use Doctrine\DBAL\Driver\Connection;
use Doctrine\DBAL\Driver\ResultStatement; use Doctrine\DBAL\Driver\ResultStatement;
use Doctrine\DBAL\Driver\ServerInfoAwareConnection; use Doctrine\DBAL\Driver\ServerInfoAwareConnection;
use Doctrine\DBAL\Driver\Statement as DriverStatement; use Doctrine\DBAL\Driver\Statement as DriverStatement;
use Doctrine\DBAL\ParameterType;
use stdClass; use stdClass;
use const DB2_AUTOCOMMIT_OFF; use const DB2_AUTOCOMMIT_OFF;
use const DB2_AUTOCOMMIT_ON; use const DB2_AUTOCOMMIT_ON;
...@@ -101,15 +100,9 @@ class DB2Connection implements Connection, ServerInfoAwareConnection ...@@ -101,15 +100,9 @@ class DB2Connection implements Connection, ServerInfoAwareConnection
/** /**
* {@inheritdoc} * {@inheritdoc}
*/ */
public function quote($input, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
$input = db2_escape_string($input); return "'" . db2_escape_string($input) . "'";
if ($type === ParameterType::INTEGER) {
return $input;
}
return "'" . $input . "'";
} }
/** /**
......
...@@ -7,7 +7,6 @@ use Doctrine\DBAL\Driver\PingableConnection; ...@@ -7,7 +7,6 @@ use Doctrine\DBAL\Driver\PingableConnection;
use Doctrine\DBAL\Driver\ResultStatement; use Doctrine\DBAL\Driver\ResultStatement;
use Doctrine\DBAL\Driver\ServerInfoAwareConnection; use Doctrine\DBAL\Driver\ServerInfoAwareConnection;
use Doctrine\DBAL\Driver\Statement as DriverStatement; use Doctrine\DBAL\Driver\Statement as DriverStatement;
use Doctrine\DBAL\ParameterType;
use mysqli; use mysqli;
use const MYSQLI_INIT_COMMAND; use const MYSQLI_INIT_COMMAND;
use const MYSQLI_OPT_CONNECT_TIMEOUT; use const MYSQLI_OPT_CONNECT_TIMEOUT;
...@@ -146,7 +145,7 @@ class MysqliConnection implements Connection, PingableConnection, ServerInfoAwar ...@@ -146,7 +145,7 @@ class MysqliConnection implements Connection, PingableConnection, ServerInfoAwar
/** /**
* {@inheritdoc} * {@inheritdoc}
*/ */
public function quote($input, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
return "'" . $this->conn->escape_string($input) . "'"; return "'" . $this->conn->escape_string($input) . "'";
} }
......
...@@ -6,14 +6,11 @@ use Doctrine\DBAL\Driver\Connection; ...@@ -6,14 +6,11 @@ use Doctrine\DBAL\Driver\Connection;
use Doctrine\DBAL\Driver\ResultStatement; use Doctrine\DBAL\Driver\ResultStatement;
use Doctrine\DBAL\Driver\ServerInfoAwareConnection; use Doctrine\DBAL\Driver\ServerInfoAwareConnection;
use Doctrine\DBAL\Driver\Statement as DriverStatement; use Doctrine\DBAL\Driver\Statement as DriverStatement;
use Doctrine\DBAL\ParameterType;
use UnexpectedValueException; use UnexpectedValueException;
use const OCI_COMMIT_ON_SUCCESS; use const OCI_COMMIT_ON_SUCCESS;
use const OCI_DEFAULT; use const OCI_DEFAULT;
use const OCI_NO_AUTO_COMMIT; use const OCI_NO_AUTO_COMMIT;
use function addcslashes; use function addcslashes;
use function is_float;
use function is_int;
use function oci_commit; use function oci_commit;
use function oci_connect; use function oci_connect;
use function oci_error; use function oci_error;
...@@ -123,14 +120,9 @@ class OCI8Connection implements Connection, ServerInfoAwareConnection ...@@ -123,14 +120,9 @@ class OCI8Connection implements Connection, ServerInfoAwareConnection
/** /**
* {@inheritdoc} * {@inheritdoc}
*/ */
public function quote($value, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
if (is_int($value) || is_float($value)) { return "'" . addcslashes(str_replace("'", "''", $input), "\000\n\r\\\032") . "'";
return $value;
}
$value = str_replace("'", "''", $value);
return "'" . addcslashes($value, "\000\n\r\\\032") . "'";
} }
/** /**
......
...@@ -2,7 +2,6 @@ ...@@ -2,7 +2,6 @@
namespace Doctrine\DBAL\Driver; namespace Doctrine\DBAL\Driver;
use Doctrine\DBAL\ParameterType;
use PDO; use PDO;
use function assert; use function assert;
...@@ -86,9 +85,9 @@ class PDOConnection implements Connection, ServerInfoAwareConnection ...@@ -86,9 +85,9 @@ class PDOConnection implements Connection, ServerInfoAwareConnection
/** /**
* {@inheritdoc} * {@inheritdoc}
*/ */
public function quote($input, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
return $this->connection->quote($input, $type); return $this->connection->quote($input);
} }
/** /**
......
...@@ -4,7 +4,6 @@ namespace Doctrine\DBAL\Driver\PDOSqlsrv; ...@@ -4,7 +4,6 @@ namespace Doctrine\DBAL\Driver\PDOSqlsrv;
use Doctrine\DBAL\Driver\PDOConnection; use Doctrine\DBAL\Driver\PDOConnection;
use Doctrine\DBAL\Driver\PDOStatement; use Doctrine\DBAL\Driver\PDOStatement;
use Doctrine\DBAL\ParameterType;
use function strpos; use function strpos;
use function substr; use function substr;
...@@ -31,9 +30,9 @@ class Connection extends PDOConnection ...@@ -31,9 +30,9 @@ class Connection extends PDOConnection
/** /**
* {@inheritDoc} * {@inheritDoc}
*/ */
public function quote($value, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
$val = parent::quote($value, $type); $val = parent::quote($input);
// Fix for a driver version terminating all values with null byte // Fix for a driver version terminating all values with null byte
if (strpos($val, "\0") !== false) { if (strpos($val, "\0") !== false) {
......
...@@ -6,10 +6,7 @@ use Doctrine\DBAL\Driver\Connection; ...@@ -6,10 +6,7 @@ use Doctrine\DBAL\Driver\Connection;
use Doctrine\DBAL\Driver\ResultStatement; use Doctrine\DBAL\Driver\ResultStatement;
use Doctrine\DBAL\Driver\ServerInfoAwareConnection; use Doctrine\DBAL\Driver\ServerInfoAwareConnection;
use Doctrine\DBAL\Driver\Statement as DriverStatement; use Doctrine\DBAL\Driver\Statement as DriverStatement;
use Doctrine\DBAL\ParameterType;
use function assert; use function assert;
use function is_float;
use function is_int;
use function is_resource; use function is_resource;
use function is_string; use function is_string;
use function sasql_affected_rows; use function sasql_affected_rows;
...@@ -159,12 +156,8 @@ class SQLAnywhereConnection implements Connection, ServerInfoAwareConnection ...@@ -159,12 +156,8 @@ class SQLAnywhereConnection implements Connection, ServerInfoAwareConnection
/** /**
* {@inheritdoc} * {@inheritdoc}
*/ */
public function quote($input, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
if (is_int($input) || is_float($input)) {
return $input;
}
return "'" . sasql_escape_string($this->connection, $input) . "'"; return "'" . sasql_escape_string($this->connection, $input) . "'";
} }
......
...@@ -6,11 +6,7 @@ use Doctrine\DBAL\Driver\Connection; ...@@ -6,11 +6,7 @@ use Doctrine\DBAL\Driver\Connection;
use Doctrine\DBAL\Driver\ResultStatement; use Doctrine\DBAL\Driver\ResultStatement;
use Doctrine\DBAL\Driver\ServerInfoAwareConnection; use Doctrine\DBAL\Driver\ServerInfoAwareConnection;
use Doctrine\DBAL\Driver\Statement as DriverStatement; use Doctrine\DBAL\Driver\Statement as DriverStatement;
use Doctrine\DBAL\ParameterType;
use const SQLSRV_ERR_ERRORS; use const SQLSRV_ERR_ERRORS;
use function is_float;
use function is_int;
use function sprintf;
use function sqlsrv_begin_transaction; use function sqlsrv_begin_transaction;
use function sqlsrv_commit; use function sqlsrv_commit;
use function sqlsrv_configure; use function sqlsrv_configure;
...@@ -95,17 +91,9 @@ class SQLSrvConnection implements Connection, ServerInfoAwareConnection ...@@ -95,17 +91,9 @@ class SQLSrvConnection implements Connection, ServerInfoAwareConnection
/** /**
* {@inheritDoc} * {@inheritDoc}
*/ */
public function quote($value, $type = ParameterType::STRING) public function quote(string $input) : string
{ {
if (is_int($value)) { return "'" . str_replace("'", "''", $input) . "'";
return $value;
}
if (is_float($value)) {
return sprintf('%F', $value);
}
return "'" . str_replace("'", "''", $value) . "'";
} }
/** /**
......
...@@ -284,15 +284,10 @@ class ExpressionBuilder ...@@ -284,15 +284,10 @@ class ExpressionBuilder
} }
/** /**
* Quotes a given input parameter. * Creates an SQL literal expression from the string.
*
* @param mixed $input The parameter to be quoted.
* @param int|null $type The type of the parameter.
*
* @return string
*/ */
public function literal($input, $type = null) public function literal(string $input)
{ {
return $this->connection->quote($input, $type); return $this->connection->quote($input);
} }
} }
...@@ -202,7 +202,7 @@ class SQLAzureShardManager implements ShardManager ...@@ -202,7 +202,7 @@ class SQLAzureShardManager implements ShardManager
$sql = 'ALTER FEDERATION ' . $this->getFederationName() . ' ' . $sql = 'ALTER FEDERATION ' . $this->getFederationName() . ' ' .
'SPLIT AT (' . $this->getDistributionKey() . ' = ' . 'SPLIT AT (' . $this->getDistributionKey() . ' = ' .
$this->conn->quote($splitDistributionValue, $type->getBindingType()) . ')'; $this->conn->quote($splitDistributionValue) . ')';
$this->conn->exec($sql); $this->conn->exec($sql);
} }
} }
...@@ -6,9 +6,7 @@ use Doctrine\DBAL\Connection; ...@@ -6,9 +6,7 @@ use Doctrine\DBAL\Connection;
use Doctrine\DBAL\ConnectionException; use Doctrine\DBAL\ConnectionException;
use Doctrine\DBAL\Driver\Connection as DriverConnection; use Doctrine\DBAL\Driver\Connection as DriverConnection;
use Doctrine\DBAL\DriverManager; use Doctrine\DBAL\DriverManager;
use Doctrine\DBAL\ParameterType;
use Doctrine\DBAL\Platforms\AbstractPlatform; use Doctrine\DBAL\Platforms\AbstractPlatform;
use Doctrine\DBAL\Types\Types;
use Doctrine\Tests\DbalFunctionalTestCase; use Doctrine\Tests\DbalFunctionalTestCase;
use Error; use Error;
use Exception; use Exception;
...@@ -287,8 +285,8 @@ class ConnectionTest extends DbalFunctionalTestCase ...@@ -287,8 +285,8 @@ class ConnectionTest extends DbalFunctionalTestCase
public function testQuote() : void public function testQuote() : void
{ {
self::assertEquals( self::assertEquals(
$this->connection->quote('foo', Types::STRING), $this->connection->quote('foo'),
$this->connection->quote('foo', ParameterType::STRING) $this->connection->quote('foo')
); );
} }
......
...@@ -177,9 +177,9 @@ class DataAccessTest extends DbalFunctionalTestCase ...@@ -177,9 +177,9 @@ class DataAccessTest extends DbalFunctionalTestCase
$paramStr = 'foo'; $paramStr = 'foo';
$stmt = $this->connection->prepare(sprintf( $stmt = $this->connection->prepare(sprintf(
'SELECT test_int, test_string FROM %s WHERE test_int = %s AND test_string = %s', 'SELECT test_int, test_string FROM %s WHERE test_int = %d AND test_string = %s',
$this->connection->quoteIdentifier($table), $this->connection->quoteIdentifier($table),
$this->connection->quote($paramInt), $paramInt,
$this->connection->quote($paramStr) $this->connection->quote($paramStr)
)); ));
self::assertInstanceOf(Statement::class, $stmt); self::assertInstanceOf(Statement::class, $stmt);
......
...@@ -46,7 +46,7 @@ class WriteTest extends DbalFunctionalTestCase ...@@ -46,7 +46,7 @@ class WriteTest extends DbalFunctionalTestCase
public function testExecuteUpdate() : void public function testExecuteUpdate() : void
{ {
$sql = 'INSERT INTO write_table (test_int) VALUES ( ' . $this->connection->quote(1) . ')'; $sql = 'INSERT INTO write_table (test_int) VALUES (1)';
$affected = $this->connection->executeUpdate($sql); $affected = $this->connection->executeUpdate($sql);
self::assertEquals(1, $affected, 'executeUpdate() should return the number of affected rows!'); self::assertEquals(1, $affected, 'executeUpdate() should return the number of affected rows!');
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment