search

envms / fluentpdo

A PHP SQL query builder using PDO
http://envms.github.io/fluentpdo/
926 stars 189 forks source link

column names not escaped correctly #226

Closed slideup-benni closed 6 years ago

slideup-benni commented 6 years ago

Hello, in my database structure exists column names like "first" and "last". When i create an insert query it fails (without error) and the row wasn't added to the table. I changed (quick and dirty) line 145 of lastQuery.php from

$columns = implode(', ', $this->columns);

to 

$columns = '`'.implode('`, `', $this->columns).'`';

and it works. I dont know if this occurs other problems, but when not it would be very nice when you could fix this. Thank you in advance

cbornhoft commented 6 years ago

Hey @slideup-benni, looks like what you're suggesting is a driver-specific fix. FluentPDO's philosophy is to support all RDBMS's that PDO itself supports. Only certain systems, like MySQL, support wrapping columns and values in backticks, hence why we don't wrap them ourselves. The ideal solution to this is to avoid (if possible) naming tables and columns using potential SQL keywords.