catfan / Medoo

The lightweight PHP database framework to accelerate the development.
https://medoo.in
MIT License
4.83k stars 1.15k forks source link

SQL functions inside functions are forcefully escaped and do not work #607

Closed rkkoszewski closed 6 years ago

rkkoszewski commented 7 years ago

So I'm trying to insert a data with that has the current date-time + some minutes in the future. This requires a function inside a function. By some reason Meedoo seems to ignore the hashtag and when there is more than one "(" it decides to quote the function, and therefore it does not work. This does not happen when I just use "NOW()" or even when I use an invalid ADDTIME(NOW).

$db->insert('test',[
            'id' => $id,
            '#time' => 'ADDTIME(NOW(),\'01:00\')'
]);

The resulting SQL is (Please note the quotes):

INSERT INTO "test" ("id", "time") VALUES ('1', 'ADDTIME(NOW(),\'01:00\')')

But:

$db->insert('test',[
            'id' => $id,
            '#time' => 'NOW()'
]);

results in the expected:

INSERT INTO "test" ("id", "time") VALUES ('1', NOW())

Is there any reason why this is happening? Is it a bug?

catfan commented 7 years ago

This feature is only worked for simple SQL function with out parameter for current version.

The good news is this we make a better and more powerful way to handle this issue on version v1.5, you can check out this branch and try it.

$database->insert('test', [
    'id' => $id,
    'time' => Medoo::raw("ADDTIME(NOW(), '01:00')")
]);