Closes #405.

Syntax for getting input properly escaped through prepared statements:
$query->set('field', 'field + ?', $value)
or
$query->set('field', 'field + ? - ?', array($value1, $value2))
or simply
$query->set('field', '?', $value)
Ticket: 405

lib/Doctrine/Node/NestedSet.php

@@ -533,10 +533,10 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
                 // Update lft/rgt/root/level for all descendants
                 $q = new Doctrine_Query($conn);
                 $q = $q->update($componentName)
-                        ->set($componentName . '.lft', 'lft + ' . $diff)
-                        ->set($componentName . '.rgt', 'rgt + ' . $diff)
-                        ->set($componentName . '.level', 'level + ' . $levelDiff)
-                        ->set($componentName . '.' . $rootColName, $newRoot)
+                        ->set($componentName . '.lft', 'lft + ?', $diff)
+                        ->set($componentName . '.rgt', 'rgt + ?', $diff)
+                        ->set($componentName . '.level', 'level + ?', $levelDiff)
+                        ->set($componentName . '.' . $rootColName, '?', $newRoot)
                         ->where($componentName . '.lft > ? AND ' . $componentName . '.rgt < ?',
                         array($oldLft, $oldRgt));
                 $q = $this->_tree->returnQueryWithRootId($q, $oldRoot);
@@ -656,10 +656,10 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
             $rootColName = $this->record->getTable()->getTree()->getAttribute('rootColumnName');
             $q = new Doctrine_Query($conn);
             $q = $q->update($componentName)
-                    ->set($componentName . '.lft', 'lft + ' . $diff)
-                    ->set($componentName . '.rgt', 'rgt + ' . $diff)
-                    ->set($componentName . '.level', 'level - ' . $oldLevel)
-                    ->set($componentName . '.' . $rootColName, $newRoot)
+                    ->set($componentName . '.lft', 'lft + ?', $diff)
+                    ->set($componentName . '.rgt', 'rgt + ?', $diff)
+                    ->set($componentName . '.level', 'level - ?', $oldLevel)
+                    ->set($componentName . '.' . $rootColName, '?', $newRoot)
                     ->where($componentName . '.lft > ? AND ' . $componentName . '.rgt < ?',
                     array($oldLft, $oldRgt));
             $q = $this->_tree->returnQueryWithRootId($q, $oldRoot);
@@ -820,7 +820,7 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
         // update level for descendants
         $q = new Doctrine_Query();
         $q = $q->update($componentName)
-                ->set($componentName . '.level', 'level + ' . $levelDiff)
+                ->set($componentName . '.level', 'level + ?', $levelDiff)
                 ->where($componentName . '.lft > ? AND ' . $componentName . '.rgt < ?',
                         array($left, $right));
         $q = $this->_tree->returnQueryWithRootId($q, $rootId);
@@ -850,7 +850,7 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
         // shift left columns
         $componentName = $this->record->getTable()->getComponentName();
         $qLeft = $qLeft->update($componentName)
-                                ->set($componentName . '.lft', 'lft + ' . $delta)
+                                ->set($componentName . '.lft', 'lft + ?', $delta)
                                 ->where($componentName . '.lft >= ?', $first);
         
         $qLeft = $this->record->getTable()->getTree()->returnQueryWithRootId($qLeft, $rootId);
@@ -859,7 +859,7 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
         
         // shift right columns
         $resultRight = $qRight->update($componentName)
-                                ->set($componentName . '.rgt', 'rgt + ' . $delta)
+                                ->set($componentName . '.rgt', 'rgt + ?', $delta)
                                 ->where($componentName . '.rgt >= ?', $first);
 
         $qRight = $this->record->getTable()->getTree()->returnQueryWithRootId($qRight, $rootId);
@@ -883,7 +883,7 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
         // shift left column values
         $componentName = $this->record->getTable()->getComponentName();
         $qLeft = $qLeft->update($componentName)
-                                ->set($componentName . '.lft', 'lft + ' . $delta)
+                                ->set($componentName . '.lft', 'lft + ?', $delta)
                                 ->where($componentName . '.lft >= ? AND ' . $componentName . '.lft <= ?', array($first, $last));
         
         $qLeft = $this->record->getTable()->getTree()->returnQueryWithRootId($qLeft, $rootId);
@@ -892,7 +892,7 @@ class Doctrine_Node_NestedSet extends Doctrine_Node implements Doctrine_Node_Int
         
         // shift right column values
         $qRight = $qRight->update($componentName)
-                                ->set($componentName . '.rgt', 'rgt + ' . $delta)
+                                ->set($componentName . '.rgt', 'rgt + ?', $delta)
                                 ->where($componentName . '.rgt >= ? AND ' . $componentName . '.rgt <= ?', array($first, $last));
 
         $qRight = $this->record->getTable()->getTree()->returnQueryWithRootId($qRight, $rootId);

lib/Doctrine/Query/Abstract.php

@@ -180,8 +180,15 @@ abstract class Doctrine_Query_Abstract extends Doctrine_Hydrate
      * @param string $update        Query UPDATE part
      * @return Doctrine_Query
      */
-    public function set($key, $value)
+    public function set($key, $value, $params = null)
     {
+        if ($params !== null) {
+            if (is_array($params)) {
+                $this->_params = array_merge($this->_params, $params);
+            } else {
+                $this->_params[] = $params;
+            }
+        }
         return $this->parseQueryPart('set', $key . ' = ' . $value, true);
     }
     /**
@@ -238,7 +245,7 @@ abstract class Doctrine_Query_Abstract extends Doctrine_Hydrate
      */
     public function where($where, $params = array())
     {
-        $this->_params = array();
+        //$this->_params = array();
         if (is_array($params)) {
             $this->_params = $params;
         } else {