Changeset 1899

Show
Ignore:
Timestamp:
10/24/08 13:07:27 (2 months ago)
Author:
mikey
Message:

make sure strings are escaped

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • framework/trunk/src/main/php/net/stubbles/rdbms/querybuilder/stubDatabaseMySQLQueryBuilder.php

    r1897 r1899  
    132132                    $queries[$tableName] .= $columnValue; 
    133133                } else { 
    134                     $queries[$tableName] .= "'" . $columnValue . "'"; 
     134                    $queries[$tableName] .= "'" . addslashes($columnValue) . "'"; 
    135135                } 
    136136                 
    …… 
    173173                    $queries[$tableName] .= $columnValue; 
    174174                } else { 
    175                     $queries[$tableName] .= "'" . $columnValue . "'"; 
     175                    $queries[$tableName] .= "'" . addslashes($columnValue) . "'"; 
    176176                } 
    177177                 

  • framework/trunk/src/test/php/net/stubbles/rdbms/querybuilder/stubDatabaseMySQLQueryBuilderTestCase.php

    r1897 r1899  
    7878    { 
    7979        $tableRow1 = new stubDatabaseTableRow('foo'); 
    80         $tableRow1->setColumn('columnName1', 'columnValue1'); 
     80        $tableRow1->setColumn('columnName1', "column'Value1"); 
    8181        $tableRow1->setColumn('columnName2', null); 
    8282        $tableRow1->setColumn('columnName3', 313); 
    …… 
    8484        $mockCriterion->expects($this->never())->method('toSQL'); 
    8585        $tableRow1->addCriterion($mockCriterion); 
    86         $this->assertEquals(array('foo' => "INSERT INTO `foo` (`columnName1`, `columnName2`, `columnName3`) VALUES ('columnValue1', NULL, 313)"), $this->mySqlQueryBuilder->createInsert(array('foo' => $tableRow1))); 
     86        $this->assertEquals(array('foo' => "INSERT INTO `foo` (`columnName1`, `columnName2`, `columnName3`) VALUES ('column\'Value1', NULL, 313)"), $this->mySqlQueryBuilder->createInsert(array('foo' => $tableRow1))); 
    8787         
    8888        $tableRow2 = new stubDatabaseTableRow('bar'); 
    8989        $tableRow2->setColumn('columnNameA', 'columnValueA'); 
    90         $this->assertEquals(array('foo' => "INSERT INTO `foo` (`columnName1`, `columnName2`, `columnName3`) VALUES ('columnValue1', NULL, 313)", 
     90        $this->assertEquals(array('foo' => "INSERT INTO `foo` (`columnName1`, `columnName2`, `columnName3`) VALUES ('column\'Value1', NULL, 313)", 
    9191                                  'bar' => "INSERT INTO `bar` (`columnNameA`) VALUES ('columnValueA')" 
    9292                            ), 
    …… 
    117117    { 
    118118        $tableRow1 = new stubDatabaseTableRow('foo'); 
    119         $tableRow1->setColumn('columnName1', 'columnValue1'); 
     119        $tableRow1->setColumn('columnName1', "column'Value1"); 
    120120        $tableRow1->setColumn('columnName2', null); 
    121121        $tableRow1->setColumn('columnName3', 313); 
    …… 
    123123        $mockCriterion->expects($this->any())->method('toSQL')->will($this->returnValue("`foo`.`id` = 'mock'")); 
    124124        $tableRow1->addCriterion($mockCriterion); 
    125         $this->assertEquals($this->mySqlQueryBuilder->createUpdate(array('foo' => $tableRow1)), array('foo' => "UPDATE `foo` SET `columnName1` = 'columnValue1', `columnName2` = NULL, `columnName3` = 313 WHERE (`foo`.`id` = 'mock')")); 
     125        $this->assertEquals($this->mySqlQueryBuilder->createUpdate(array('foo' => $tableRow1)), array('foo' => "UPDATE `foo` SET `columnName1` = 'column\'Value1', `columnName2` = NULL, `columnName3` = 313 WHERE (`foo`.`id` = 'mock')")); 
    126126         
    127127        $tableRow2 = new stubDatabaseTableRow('bar'); 
    128128        $tableRow2->setColumn('columnNameA', 'columnValueA'); 
    129129        $this->assertEquals($this->mySqlQueryBuilder->createUpdate(array('foo' => $tableRow1, 
    130                                                                         'bar' => $tableRow2 
     130                                                                        'bar' => $tableRow2 
    131131                                                                  ) 
    132132                           ), 
    133                            array('foo' => "UPDATE `foo` SET `columnName1` = 'columnValue1', `columnName2` = NULL, `columnName3` = 313 WHERE (`foo`.`id` = 'mock')", 
     133                           array('foo' => "UPDATE `foo` SET `columnName1` = 'column\'Value1', `columnName2` = NULL, `columnName3` = 313 WHERE (`foo`.`id` = 'mock')", 
    134134                                 'bar' => "UPDATE `bar` SET `columnNameA` = 'columnValueA'" 
    135135                           )