Merge pull request #10 from noahheck/SubstringReplacement

Add proper substring parameter replacement
noahheck · Nov 9, 2016 · 9bbe64f · 9bbe64f
2 parents 53ae8de + 9de4072
commit 9bbe64f
Show file tree

Hide file tree

Showing 2 changed files with 61 additions and 4 deletions.
diff --git a/src/EPDOStatement.php b/src/EPDOStatement.php
@@ -137,7 +137,7 @@ private function replaceMarker($queryString, $marker, $replValue)
             $marker = (preg_match("/^:/", $marker)) ? $marker : ":" . $marker;
         }
 
-        $testParam = "/" . $marker . "(?!\w)/";
+        $testParam = "/({$marker}(?!\w))(?=(?:[^\"']|[\"'][^\"']*[\"'])*$)/";
 
         return preg_replace($testParam, $replValue, $queryString, 1);
     }
@@ -169,11 +169,10 @@ public function execute($inputParams = null)
      */
     private function prepareValue($value)
     {
-        if ($value['value'] === NULL)
-        {
+        if ($value['value'] === NULL) {
             return 'NULL';
         }
-        
+
         if (!$this->_pdo) {
             return "'" . addslashes($value['value']) . "'";
         }

diff --git a/tests/src/EPDOStatementTest.php b/tests/src/EPDOStatementTest.php
@@ -170,6 +170,44 @@ public function testValuesGetInterpolatedIntoQueryWhenProvidedAsUnnamedInputPara
 		$this->assertTrue(false == preg_match("/\?/", $result));
 	}
 
+	public function testValuesGetInterpolatedIntoQueryEvenWhenReplacementValueContainsAPlaceholderUsingUnnamedParameters()
+	{
+		$pdo = $this->getPdo();
+
+		$query = "UPDATE logs SET logContent = ?, summary = ?";
+		$stmt = $pdo->prepare($query);
+
+		$parameters = array(
+			  "String contains a ?"
+			, "Some other value"
+		);
+
+		$result = $stmt->interpolateQuery($parameters);
+
+		$expected = "UPDATE logs SET logContent = 'String contains a ?', summary = 'Some other value'";
+
+		$this->assertEquals($expected, $result);
+	}
+
+	public function testValuesGetInterpolatedIntoQueryEvenWhenReplacementValueContainsAPlaceholderUsingNamedParameters()
+	{
+		$pdo = $this->getPdo();
+
+		$query = "UPDATE logs SET logContent = :logContent, summary = :summary";
+		$stmt = $pdo->prepare($query);
+
+		$parameters = array(
+			  ":logContent" => "String contains :summary"
+			, ":summary"    => "Some other value"
+		);
+
+		$result = $stmt->interpolateQuery($parameters);
+
+		$expected = "UPDATE logs SET logContent = 'String contains :summary', summary = 'Some other value'";
+
+		$this->assertEquals($expected, $result);
+	}
+
 	public function testValuesGetInterpolatedCorrectlyWhenSimilarlyNamedPlaceholdersAreUsed()
 	{
 		$pdo = $this->getPdo();
@@ -198,6 +236,26 @@ public function testValuesGetInterpolatedCorrectlyWhenSimilarlyNamedPlaceholders
 		$this->assertTrue(false == preg_match("/:log/", $result));
 	}
 
+	public function testNullValuesAreInterpolatedCorrectlyAsDbNullValues()
+	{
+		$pdo = $this->getPdo();
+
+		$query = "UPDATE logs SET logContent = :logContent WHERE log = :log";
+		$stmt = $pdo->prepare($query);
+
+		$logContent = null;
+		$log = 123;
+
+		$stmt->bindParam(":logContent", $logContent, PDO::PARAM_STR);
+		$stmt->bindParam(":log"       , $log       , PDO::PARAM_INT);
+
+		$expected = "UPDATE logs SET logContent = NULL WHERE log = 123";
+
+		$result = $stmt->interpolateQuery();
+
+		$this->assertEquals($expected, $result);
+	}
+
 	public function testInterpolationAllowsSuccessfulExecutionOfQueries()
 	{
 		$pdo = $this->getPdo();