Prefer inference-placeholder over taint-escape sql (#536)

Author: staabm

src/QueryReflection/QueryReflection.php

@@ -337,14 +337,14 @@ private function resolveQueryStringExpr(Expr $queryExpr, Scope $scope, bool $res
         }
 
         if ($queryExpr instanceof Expr\CallLike) {
-            if ('sql' === PhpDocUtil::matchTaintEscape($queryExpr, $scope)) {
-                return '1';
-            }
-
             $placeholder = PhpDocUtil::matchInferencePlaceholder($queryExpr, $scope);
             if (null !== $placeholder) {
                 return $placeholder;
             }
+
+            if ('sql' === PhpDocUtil::matchTaintEscape($queryExpr, $scope)) {
+                return '1';
+            }
         }
 
         if ($queryExpr instanceof Concat) {

tests/rules/UnresolvableQueryMethodRuleTest.php

@@ -65,4 +65,11 @@ public function testSyntaxErrorInQueryRule(): void
             ],
         ]);
     }
+
+    public function testBug536(): void
+    {
+        require_once __DIR__ . '/data/bug-536.php';
+
+        $this->analyse([__DIR__ . '/data/bug-536.php'], []);
+    }
 }

tests/rules/data/bug-536.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace Bug536;
+
+use PDO;
+
+function taintEscapedAndInferencePlaceholder(PDO $pdo, string $s)
+{
+    $pdo->query('SELECT email, adaid FROM '. X::getTablePrefix('ada'), PDO::FETCH_ASSOC);
+}
+
+class X {
+    /**
+     * Returns the table prefix.
+     *
+     * @return non-empty-string
+     *
+     * @phpstandba-inference-placeholder 'ada'
+     * @psalm-taint-escape sql
+     */
+    public static function getTablePrefix()
+    {
+
+    }
+
+}