-
-
Notifications
You must be signed in to change notification settings - Fork 88
Description
I'm using version 2.0.0, and when I'm using prepared statement and making insert, I have a problem with inccorect escaping of single quote. Example:
/** @var FOD\DBALClickHouse\ClickHouseConnection $connection */
$stmt = $connection->prepare("INSERT INTO my_table (some_val) VALUES (?)");
$stmt->execute(["some ' value"]);
// HttpCode:400 ; ;Code: 62, e.displayText() = DB::Exception: Cannot parse expression of type String() here: 'some \'' value'
The problem as I see it lays inside class \FOD\DBALClickHouse\ClickHousePlatform.
public function quoteStringLiteral($str): string
{
return parent::quoteStringLiteral(addslashes($str));
}
It adds slashes before single/double quote etc. But inside parent method of \Doctrine\DBAL\Platforms\AbstractPlatform, there is different type of escaping as I see (doubling of quote).
public function quoteStringLiteral($str)
{
$c = $this->getStringLiteralQuoteCharacter();
return $c . str_replace($c, $c . $c, $str) . $c;
}
So eventually in such conditions, my value becomes some \'' value
. This leads to an error of query execution at ClickHouse server. Previosly, this quoteStringLiteral
method was looking like this:
public function quoteStringLiteral($str) : string
{
$c = $this->getStringLiteralQuoteCharacter();
return $c . addslashes($str) . $c;
}
I think additional addslashes is redundant in current (v2.0.0) implementation. But I'm open to discuss this in order to find best working solutions with this problem.