Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: RawSql() triggers an error when used in combination with like() and countAllResults() #7268

Closed
skycyclone opened this issue Feb 17, 2023 · 3 comments · Fixed by #7277
Closed
Assignees
Labels
bug Verified issues on the current code behavior or pull requests that will fix them database Issues or pull requests that affect the database layer

Comments

@skycyclone
Copy link

skycyclone commented Feb 17, 2023

PHP Version

8.1

CodeIgniter4 Version

4.3.1

CodeIgniter4 Installation Method

Composer (using codeigniter4/appstarter)

Which operating systems have you tested for this bug?

Windows

Which server did you use?

apache

Database

No response

What happened?

$builder = $this->db->table('users');
$builder->select('id');
$builder->like(new RawSql("CONCAT(username, email)"), 'sky');
$count = $builder->countAllResults(FALSE);
$tableList = $builder->get()->getResultArray();

In Query Builder Class, if you use new RawSql() in $builder ->like(), and then use $builder ->countAllResults (FALSE); An error will be triggered when the total number of query results is obtained and then the query results are obtained.

Error prompt:

code: 500
file:"G:\\Code\\website\\ci4_cms\\vendor\\codeigniter4\\framework\\system\\Database\\BaseBuilder.php"
line: 3071
message: "Cannot use object of type CodeIgniter\\Database\\RawSql as array"

After debugging, it is found that if the countAllResults parameter is not set to FALSE, no error will be reported, but the subsequent get() cannot obtain the correct query results;

In addition, the third parameter of get() can also reset the query object. After setting, $builder ->countAllResults(); The same error is reported!

Problem conclusion: New RawSql() cannot be used in the link() before resetting values for SELECT; Or if you want to use new RawSql(), you cannot reset values for SELECTs??

Steps to Reproduce

$builder = $this->db->table('users');
$builder->select('id');
$builder->like(new RawSql("CONCAT(username, email)"), 'sky');
$count = $builder->countAllResults(FALSE);
$tableList = $builder->get(25, 0)->getResultArray();

or

$builder = $this->db->table('users');
$builder->select('id');
$builder->like(new RawSql("CONCAT(username, email)"), 'sky');
$tableList = $builder->get(25, 0, FALSE)->getResultArray();
$count = $builder->countAllResults();

Expected Output

Get the total number of query results and query result array normally

Anything else?

No response

@skycyclone skycyclone added the bug Verified issues on the current code behavior or pull requests that will fix them label Feb 17, 2023
@skycyclone
Copy link
Author

What's more, I don't understand what the role of new RawSql() is. Even though I have roughly looked at the source file of RawSql, I still don't understand whether it is for security protection or to generate objects for the next reuse to improve efficiency??

@kenjis
Copy link
Member

kenjis commented Feb 17, 2023

Thank you for reporting.

RawSql expresses raw SQL strings. That's all.
Normally, values passed to QueryBuilder are escaped, protected, DBPrefix-added, or otherwise manipulated.
RawSql ensures that no such processing occurs.

It does not provide any security protection. You must ensure it is safe by yourself.

@kenjis kenjis added the database Issues or pull requests that affect the database layer label Feb 17, 2023
@kenjis kenjis changed the title Bug: new RawSql ($sql) triggers an error when used in combination with like() and countAllResults() Bug: RawSql() triggers an error when used in combination with like() and countAllResults() Feb 17, 2023
@kenjis kenjis self-assigned this Feb 19, 2023
@kenjis
Copy link
Member

kenjis commented Feb 19, 2023

I sent a PR to fix this: #7277

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Verified issues on the current code behavior or pull requests that will fix them database Issues or pull requests that affect the database layer
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants