cvs: pear /DB/DB common.php oci8.php

danielc Sun Jan 4 00:58:46 2004 EDT Modified files: /pear/DB/DB oci8.php common.php Log: prepare() now allows placeholder characters to be escaped so they can be used in literals. Bug 31. Index: pear/DB/DB/oci8.php diff -u pear/DB/DB/oci8.php:1.22 pear/DB/DB/oci8.php:1.23 --- pear/DB/DB/oci8.php:1.22 Sat Jan 3 15:48:37 2004 +++ pear/DB/DB/oci8.php Sun Jan 4 00:58:45 2004 @@ -16,7 +16,7 @@ // | Author: James L. Pine <jlp@valinux.com> | // +----------------------------------------------------------------------+ // -// $Id: oci8.php,v 1.22 2004/01/03 20:48:37 danielc Exp $ +// $Id: oci8.php,v 1.23 2004/01/04 05:58:45 danielc Exp $ // // Database independent query interface definition for PHP's Oracle 8 // call-interface extension. @@ -368,37 +368,62 @@ // {{{ prepare() /** - * Prepares a query for multiple execution with execute(). With - * oci8, this is emulated. - * @param $query query to be prepared + * Prepares a query for multiple execution with execute(). * - * @return DB statement resource + * With oci8, this is emulated. + * + * prepare() requires a generic query as string like <samp> + * INSERT INTO numbers VALUES (?, ?, ?) + * </samp>. The <samp>?</samp> characters are placeholders. + * + * Three types of placeholders can be used: + * + <samp>?</samp> a quoted scalar value, i.e. strings, integers + * + <samp>!</samp> value is inserted 'as is' + * + <samp>&</samp> requires a file name. The file's contents get + * inserted into the query (i.e. saving binary + * data in a db) + * + * Use backslashes to escape placeholder characters if you don't want + * them to be interpreted as placeholders. Example: <samp> + * "UPDATE foo SET col=? WHERE col='over \& under'" + * </samp> + * + * @param string $query query to be prepared + * @return mixed DB statement resource on success. DB_Error on failure. */ function prepare($query) { - $tokens = split('[&?!]', $query); - $token = 0; - $types = array(); - $qlen = strlen($query); - for ($i = 0; $i < $qlen; $i++) { - switch ($query[$i]) { + $tokens = preg_split('/((?<!\\\)[&?!])/', $query, -1, + PREG_SPLIT_DELIM_CAPTURE); + $binds = count($tokens) - 1; + $token = 0; + $types = array(); + $newquery = ''; + + foreach ($tokens as $key => $val) { + switch ($val) { case '?': $types[$token++] = DB_PARAM_SCALAR; + unset($tokens[$key]); break; case '&': $types[$token++] = DB_PARAM_OPAQUE; + unset($tokens[$key]); break; case '!': $types[$token++] = DB_PARAM_MISC; + unset($tokens[$key]); break; + default: + $tokens[$key] = preg_replace('/\\\([&?!])/', "\\1", $val); + if ($key != $binds) { + $newquery .= $tokens[$key] . ':bind' . $token; + } else { + $newquery .= $tokens[$key]; + } } } - $binds = sizeof($tokens) - 1; - $newquery = ''; - for ($i = 0; $i < $binds; $i++) { - $newquery .= $tokens[$i] . ':bind' . $i; - } - $newquery .= $tokens[$i]; + $this->last_query = $query; $newquery = $this->modifyQuery($newquery); if (!$stmt = @OCIParse($this->connection, $newquery)) { @@ -446,7 +471,7 @@ fclose($fp); } } - if (!@OCIBindByName($stmt, ':bind' . $i, $pdata[$i], -1)) { + if (!OCIBindByName($stmt, ':bind' . $i, $pdata[$i], -1)) { $tmp = $this->oci8RaiseError($stmt); return $tmp; } Index: pear/DB/DB/common.php diff -u pear/DB/DB/common.php:1.35 pear/DB/DB/common.php:1.36 --- pear/DB/DB/common.php:1.35 Sat Jan 3 02:01:46 2004 +++ pear/DB/DB/common.php Sun Jan 4 00:58:45 2004 @@ -17,7 +17,7 @@ // | Tomas V.V.Cox <cox@idecnet.com> | // +----------------------------------------------------------------------+ // -// $Id: common.php,v 1.35 2004/01/03 07:01:46 danielc Exp $ +// $Id: common.php,v 1.36 2004/01/04 05:58:45 danielc Exp $ // // Base class for DB implementations. // @@ -29,7 +29,7 @@ * inherited by all such. * * @package DB - * @version $Id: common.php,v 1.35 2004/01/03 07:01:46 danielc Exp $ + * @version $Id: common.php,v 1.36 2004/01/04 05:58:45 danielc Exp $ * @category Database * @author Stig Bakken <ssb@php.net> * @author Tomas V.V.Cox <cox@idecnet.com> @@ -397,33 +397,41 @@ // {{{ prepare() /** - * Prepares a query for multiple execution with execute(). - * With some database backends, this is emulated. - * prepare() requires a generic query as string like - * "INSERT INTO numbers VALUES(?,?,?)". The ? are wildcards. - * Types of wildcards: - * ? - a quoted scalar value, i.e. strings, integers - * & - requires a file name, the content of the file - * insert into the query (i.e. saving binary data - * in a db) - * ! - value is inserted 'as is' - * - * @param string the query to prepare - * - * @return resource handle for the query - * - * @access public - * @see execute - */ - + * Prepares a query for multiple execution with execute(). + * + * With some database backends, this is emulated. + * + * prepare() requires a generic query as string like <samp> + * INSERT INTO numbers VALUES (?, ?, ?) + * </samp>. The <samp>?</samp> characters are placeholders. + * + * Three types of placeholders can be used: + * + <samp>?</samp> a quoted scalar value, i.e. strings, integers + * + <samp>!</samp> value is inserted 'as is' + * + <samp>&</samp> requires a file name. The file's contents get + * inserted into the query (i.e. saving binary + * data in a db) + * + * Use backslashes to escape placeholder characters if you don't want + * them to be interpreted as placeholders. Example: <samp> + * "UPDATE foo SET col=? WHERE col='over \& under'" + * </samp> + * + * @param string $query query to be prepared + * @return mixed DB statement resource on success. DB_Error on failure. + * @access public + * @see execute() + */ function prepare($query) { - $tokens = split('[&?!]', $query); - $token = 0; - $types = array(); - $qlen = strlen($query); - for ($i = 0; $i < $qlen; $i++) { - switch ($query[$i]) { + $tokens = preg_split('/((?<!\\\)[&?!])/', $query, -1, + PREG_SPLIT_DELIM_CAPTURE); + $token = 0; + $types = array(); + $newtokens = array(); + + foreach ($tokens as $key => $val) { + switch ($val) { case '?': $types[$token++] = DB_PARAM_SCALAR; break; @@ -433,15 +441,17 @@ case '!': $types[$token++] = DB_PARAM_MISC; break; + default: + $newtokens[] = preg_replace('/\\\([&?!])/', "\\1", $val); } } - - $this->prepare_tokens[] = &$tokens; + + $this->prepare_tokens[] = &$newtokens; end($this->prepare_tokens); $k = key($this->prepare_tokens); $this->prepare_types[$k] = $types; - $this->prepared_queries[$k] = &$query; + $this->prepared_queries[$k] = implode(' ', $newtokens); return $k; }