Skip to content

Commit 0118d48

Browse files
tmotylihor-sviziev
andcommitted
Fix SQL query quoting/casting when type is passed to where function
The $type variable can be both string or int, so before comparing it to 'TYPE_CONDITION' string it has to be casted to avoid comparing integer zero with string (0 == 'TYPE_CONDITION') which will wrongly return true, and remove the information about type. Pass type provided to where function down the chain to allow automatic casting of arrays of values e.g. to int. This fixes following cases: 1) ->where('attr_table.store_id IN (?)', $storeIds, Zend_Db::INT_TYPE); 2) ->where('attr_table.store_id = ?', $storeId, Zend_Db::INT_TYPE); In both cases now passed value is correctly casted to int (either single value, or each value from array) Co-authored-by: Ihor Sviziev <ihor-sviziev@users.noreply.github.com>
1 parent 39012d4 commit 0118d48

File tree

2 files changed

+10
-8
lines changed

2 files changed

+10
-8
lines changed

lib/internal/Magento/Framework/DB/Adapter/Pdo/Mysql.php

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
use Magento\Framework\DB\Query\Generator as QueryGenerator;
2222
use Magento\Framework\DB\Select;
2323
use Magento\Framework\DB\SelectFactory;
24+
use Magento\Framework\DB\Sql\Expression;
2425
use Magento\Framework\DB\Statement\Parameter;
2526
use Magento\Framework\Exception\LocalizedException;
2627
use Magento\Framework\Phrase;
@@ -1511,10 +1512,10 @@ public function select()
15111512
* Method revrited for handle empty arrays in value param
15121513
*
15131514
* @param string $text The text with a placeholder.
1514-
* @param mixed $value The value to quote.
1515-
* @param string $type OPTIONAL SQL datatype
1515+
* @param array|null|int|string|float|Expression|Select|\DateTimeInterface $value The value to quote.
1516+
* @param int|string|null $type OPTIONAL SQL datatype of the given value e.g. Zend_Db::FLOAT_TYPE or "INT"
15161517
* @param integer $count OPTIONAL count of placeholders to replace
1517-
* @return string An SQL-safe quoted value placed into the orignal text.
1518+
* @return string An SQL-safe quoted value placed into the original text.
15181519
*/
15191520
public function quoteInto($text, $value, $type = null, $count = null)
15201521
{

lib/internal/Magento/Framework/DB/Select.php

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
use Magento\Framework\App\ResourceConnection;
99
use Magento\Framework\DB\Adapter\AdapterInterface;
10+
use Magento\Framework\DB\Sql\Expression;
1011

1112
/**
1213
* Class for SQL SELECT generation and results.
@@ -107,19 +108,19 @@ public function __construct(
107108
* </code>
108109
*
109110
* @param string $cond The WHERE condition.
110-
* @param string|array|null $value OPTIONAL An optional single or array value to quote into the condition.
111-
* @param string|int|null $type OPTIONAL The type of the given value
112-
* @return \Magento\Framework\DB\Select
111+
* @param array|null|int|string|float|Expression|Select|\DateTimeInterface $value The value to quote.
112+
* @param int|string|null $type OPTIONAL SQL datatype of the given value e.g. Zend_Db::FLOAT_TYPE or "INT"
113+
* @return Select
113114
*/
114115
public function where($cond, $value = null, $type = null)
115116
{
116117
if ($value === null && $type === null) {
117118
$value = '';
118-
} elseif ($type == self::TYPE_CONDITION) {
119+
} elseif ((string)$type === self::TYPE_CONDITION) {
119120
$type = null;
120121
}
121122
if (is_array($value)) {
122-
$cond = $this->getConnection()->quoteInto($cond, $value);
123+
$cond = $this->getConnection()->quoteInto($cond, $value, $type);
123124
$value = null;
124125
}
125126
return parent::where($cond, $value, $type);

0 commit comments

Comments
 (0)