Skip to content

Commit a800da0

Browse files
sclubricantssclubricants
committed
Use str_replace instead of sprintf
To avoid issues where sql has % in it. Used a unique string to replace.
1 parent ac63bb9 commit a800da0

File tree

5 files changed

+20
-20
lines changed

5 files changed

+20
-20
lines changed

‎system/Database/BaseBuilder.php

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1973,7 +1973,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
19731973
// if this is the first iteration of batch then we need to build skeleton sql
19741974
if ($sql === '') {
19751975
$sql = 'INSERT ' . $this->compileIgnore('insert') . 'INTO ' . $table
1976-
. ' (' . implode(', ', $keys) . ")\n%s";
1976+
. ' (' . implode(', ', $keys) . ")\n{:_table_:}";
19771977

19781978
$this->QBOptions['sql'] = $sql;
19791979
}
@@ -1984,7 +1984,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
19841984
$data = 'VALUES ' . implode(', ', $this->formatValues($values));
19851985
}
19861986

1987-
return sprintf($sql, $data);
1987+
return str_replace('{:_table_:}', $data, $sql);
19881988
}
19891989

19901990
/**
@@ -2334,22 +2334,22 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
23342334
",\n",
23352335
array_map(
23362336
static fn ($key, $value) => $key . ($value instanceof RawSql ?
2337-
' = ' . str_replace('%', '%%', $value) :
2337+
' = ' . $value :
23382338
' = ' . $alias . '.' . $value),
23392339
array_keys($updateFields),
23402340
$updateFields
23412341
)
23422342
) . "\n";
23432343

2344-
$sql .= 'FROM (' . "\n%s";
2344+
$sql .= 'FROM (' . "\n{:_table_:}";
23452345

23462346
$sql .= ') ' . $alias . "\n";
23472347

23482348
$sql .= 'WHERE ' . implode(
23492349
' AND ',
23502350
array_map(
23512351
static fn ($key) => ($key instanceof RawSql ?
2352-
str_replace('%', '%%', (string) $key) :
2352+
$key :
23532353
$table . '.' . $key . ' = ' . $alias . '.' . $key),
23542354
$constraints
23552355
)
@@ -2374,7 +2374,7 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
23742374
) . "\n";
23752375
}
23762376

2377-
return sprintf($sql, $data);
2377+
return str_replace('{:_table_:}', $data, $sql);
23782378
}
23792379

23802380
/**

‎system/Database/MySQLi/Builder.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,15 +83,15 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
8383

8484
$sql = 'UPDATE ' . $this->compileIgnore('update') . $table . "\n";
8585

86-
$sql .= 'INNER JOIN (' . "\n%s";
86+
$sql .= 'INNER JOIN (' . "\n{:_table_:}";
8787

8888
$sql .= ') ' . $alias . "\n";
8989

9090
$sql .= 'ON ' . implode(
9191
' AND ',
9292
array_map(
9393
static fn ($key) => ($key instanceof RawSql ?
94-
str_replace('%', '%%', (string) $key) :
94+
$key :
9595
$table . '.' . $key . ' = ' . $alias . '.' . $key),
9696
$constraints
9797
)
@@ -103,7 +103,7 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
103103
",\n",
104104
array_map(
105105
static fn ($key, $value) => $table . '.' . $key . ($value instanceof RawSql ?
106-
' = ' . str_replace('%', '%%', $value) :
106+
' = ' . $value :
107107
' = ' . $alias . '.' . $value),
108108
array_keys($updateFields),
109109
$updateFields
@@ -129,6 +129,6 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
129129
) . "\n";
130130
}
131131

132-
return sprintf($sql, $data);
132+
return str_replace('{:_table_:}', $data, $sql);
133133
}
134134
}

‎system/Database/OCI8/Builder.php

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
7676
$hasPrimaryKey = in_array('PRIMARY', array_column($this->db->getIndexData($table), 'type'), true);
7777

7878
// ORA-00001 measures
79-
$sql = 'INSERT' . ($hasPrimaryKey ? '' : ' ALL') . ' INTO ' . $table . ' (' . $insertKeys . ")\n%s";
79+
$sql = 'INSERT' . ($hasPrimaryKey ? '' : ' ALL') . ' INTO ' . $table . ' (' . $insertKeys . ")\n{:_table_:}";
8080

8181
$this->QBOptions['sql'] = $sql;
8282
}
@@ -97,7 +97,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
9797
) . " FROM DUAL\n";
9898
}
9999

100-
return sprintf($sql, $data);
100+
return str_replace('{:_table_:}', $data, $sql);
101101
}
102102

103103
/**
@@ -264,15 +264,15 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
264264
// Oracle doesn't support ignore on updates so we will use MERGE
265265
$sql = 'MERGE INTO ' . $table . "\n";
266266

267-
$sql .= 'USING (' . "\n%s";
267+
$sql .= 'USING (' . "\n{:_table_:}";
268268

269269
$sql .= ') ' . $alias . "\n";
270270

271271
$sql .= 'ON (' . implode(
272272
' AND ',
273273
array_map(
274274
static fn ($key) => ($key instanceof RawSql ?
275-
str_replace('%', '%%', (string) $key) :
275+
$key :
276276
$table . '.' . $key . ' = ' . $alias . '.' . $key),
277277
$constraints
278278
)
@@ -286,7 +286,7 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
286286
",\n",
287287
array_map(
288288
static fn ($key, $value) => $table . '.' . $key . ($value instanceof RawSql ?
289-
' = ' . str_replace('%', '%%', $value) :
289+
' = ' . $value :
290290
' = ' . $alias . '.' . $value),
291291
array_keys($updateFields),
292292
$updateFields
@@ -312,6 +312,6 @@ protected function _updateBatch(string $table, array $keys, array $values): stri
312312
) . "\n";
313313
}
314314

315-
return sprintf($sql, $data);
315+
return str_replace('{:_table_:}', $data, $sql);
316316
}
317317
}

‎system/Database/Postgre/Builder.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
200200

201201
// if this is the first iteration of batch then we need to build skeleton sql
202202
if ($sql === '') {
203-
$sql = 'INSERT INTO ' . $table . '(' . implode(', ', $keys) . ")\n%s\n";
203+
$sql = 'INSERT INTO ' . $table . '(' . implode(', ', $keys) . ")\n{:_table_:}\n";
204204

205205
$sql .= $this->compileIgnore('insert');
206206

@@ -213,7 +213,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
213213
$data = 'VALUES ' . implode(', ', $this->formatValues($values));
214214
}
215215

216-
return sprintf($sql, $data);
216+
return str_replace('{:_table_:}', $data, $sql);
217217
}
218218

219219
/**

‎system/Database/SQLSRV/Builder.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
185185
// if this is the first iteration of batch then we need to build skeleton sql
186186
if ($sql === '') {
187187
$sql = 'INSERT ' . $this->compileIgnore('insert') . 'INTO ' . $this->getFullName($table)
188-
. ' (' . implode(', ', $keys) . ")\n%s";
188+
. ' (' . implode(', ', $keys) . ")\n{:_table_:}";
189189

190190
$this->QBOptions['sql'] = $sql;
191191
}
@@ -196,7 +196,7 @@ protected function _insertBatch(string $table, array $keys, array $values): stri
196196
$data = 'VALUES ' . implode(', ', $this->formatValues($values));
197197
}
198198

199-
return sprintf($sql, $data);
199+
return str_replace('{:_table_:}', $data, $sql);
200200
}
201201

202202
/**

0 commit comments

Comments
 (0)