FriendsOfDoctrine / dbal-clickhouse

Doctrine DBAL driver for ClickHouse database
GNU General Public License v3.0
98 stars 80 forks source link

Incorrect escaping of single quote in ClickHouseStatement::resolveType #64

Open constantin-gordienko-quarks-tech opened 3 months ago

constantin-gordienko-quarks-tech commented 3 months ago

I'm using version 2.0.0, and when I'm using prepared statement and making insert, I have a problem with inccorect escaping of single quote. Example:

/** @var FOD\DBALClickHouse\ClickHouseConnection $connection */
$stmt = $connection->prepare("INSERT INTO my_table (some_val) VALUES (?)");
$stmt->execute(["some ' value"]);

// HttpCode:400 ;  ;Code: 62, e.displayText() = DB::Exception: Cannot parse expression of type String() here: 'some \'' value'

The problem as I see it lays inside class \FOD\DBALClickHouse\ClickHousePlatform.

public function quoteStringLiteral($str): string
{
    return parent::quoteStringLiteral(addslashes($str));
}

It adds slashes before single/double quote etc. But inside parent method of \Doctrine\DBAL\Platforms\AbstractPlatform, there is different type of escaping as I see (doubling of quote).

public function quoteStringLiteral($str)
{
    $c = $this->getStringLiteralQuoteCharacter();

    return $c . str_replace($c, $c . $c, $str) . $c;
}

So eventually in such conditions, my value becomes some \'' value. This leads to an error of query execution at ClickHouse server. Previosly, this quoteStringLiteral method was looking like this:

public function quoteStringLiteral($str) : string
{
    $c = $this->getStringLiteralQuoteCharacter();

    return $c . addslashes($str) . $c;
}

I think additional addslashes is redundant in current (v2.0.0) implementation. But I'm open to discuss this in order to find best working solutions with this problem.