DB query not working with disabled escaping

[puschie286]

---

disabling query escaping result in exception

Describe the bug
when using query function with disabled escaping the binds doesn't store escape state, so Query.php:479 will throw an invalid index exception.

CodeIgniter 4 version
4.0.0-alpha4 ( 13aa2ab )

Affected module(s)
system/Database/Query

Context

• OS: Win 10
• Web server Apache 2.4.29 (64)
• PHP version 7.2.3 (64)

[puschie286]

other problems found in Model : it double escape all binds
--> Model:634 $this->builder()->set($data['data'], '', $escape)->insert();
set method escapes, insert method ( BaseConnection:query -> Query:setQuery escapes )

[lonnieezell]

Can you provide example code? I'm not seeing that.

Also - binds are not escaped until the Query builds it, no matter how many times you tell it to skip or not. Identifiers might be ran through the protectIdentifiers method multiple times, but I have not seen any issues of problems being caused by it. Can you provide code that any issue is created there?

[puschie286]

Problem 1 :
You need to configure "DatabaseHandler" as sessionDriver ( and database access )
than start session and do any query with binds ( Note: doesnt crash with arrays and string ( count > 2 ) )

Services::session()->start();
Database::connect()->query( 'SELECT A FROM B WHERE C=?', [ '2' ] );

=> ErrorException: Uninitialized string offset: 1 SYSTEMPATH/Database\Query.php at line 479

[puschie286]

Problem 2 :
You need to configure Database access
Create a model and entity ( for example use sessions table and entity with id as field )

class ExampleEntity extends Entity
{
	protected $id;
	protected $timestamp;
}
class ExampleModel extends Model
{
	protected $table 		= 'sessions';
	protected $primaryKey		= 'id';
	protected $returnType		= '\App\Models\ExampleEntity';
}

$Model =  new ExampleModel();
$Entity = $Model->find( '0' );
$New = $Entity === null;
if( $New ) $Entity = new ExampleEntity( ['id' => '0' ] );
Database::connect()->setEscapeFlags( true );
$Entity->timestamp = 0;
if( $New ) $Model->protect(false)->insert( $Entity, false );
else $Model->protect(false)->update( '0', $Entity );

both insert and update will fail ( but only if you call Model->find before )
=> mysqli_sql_exception '#1241' Operand should contain 1 column(s)
=> ErrorException: Array to string conversion SYSTEMPATH/Database\Query.php at line 433

[lonnieezell]

Problem one sounds like it's because of missing quotes in the generated query. While your example should work passing 2 as the parameter bound, any alpha characters would throw a SQL error because there would not be any quotes surrounding the parameter, which happens during escaping. Not sure what the session has to do with this at all...

That's not a bug in the framework, though.

[puschie286]

why do you close it ? pls try the provided code -.-
dont get your point, these things broke after escaping update and no the query doesnt work at all no matter what parameter i use ( except array of cause ).
same as the model
-> this is an escaping problem!