| Package home | Report new bug | New search | Development Roadmap | Status: Open | Feedback | All | Closed Since Version 2.5.0b5 |
| Bug #15100 | listTableFields does escape table names in the SQL (MySQL) | ||
|---|---|---|---|
| Submitted: | 2008-11-20 14:43 UTC | ||
| From: | mortorayecircle | Assigned: | quipo |
| Status: | Closed | Package: | MDB2 (version 2.4.1) |
| PHP Version: | 5.2.4 | OS: | Linux |
| Roadmaps: | (Not assigned) | ||
[2008-11-20 14:43 UTC] mortorayecircle
(DamnUpper CaseName)
Description:
------------
The MDB2_Driver_Manager_Common::listTableFields function does not properly escape table names. For example, using MySQL, with a table named convert, it produced this statement:
SHOW COLUMNS FROM convert
It should be:
SHOW COLUMNS FROM `convert`
Test script:
---------------
$mdb->listTableFields( 'sometable' ); where 'sometable' has a column called 'convert'.
Expected result:
----------------
A field listing.
Actual result:
--------------
Native message: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'convert' at line 1
Comments
[2008-11-20 15:12 UTC] mortorayecircle
(DamnUpper CaseName)
getTableFieldDefinition has the same problem.
[2008-11-23 18:06 UTC] quipo
(Lorenzo Alberton)
Make sure the 'quote_identifier' option is tuned on:
$mdb2->setOption('quote_identifier', true);
http://pear.php.net/manual/en/package.database.mdb2.intro-
quote.php
[2008-11-24 07:35 UTC] mortorayecircle
(DamnUpper CaseName)
Okay. That works. I suppose I would expect that to be the default setting however.
[2008-11-24 09:12 UTC] quipo
(Lorenzo Alberton)
No, it's not the default behavior. Ideally, you wouldn't need to quote the identifiers if you didn't use reserved keywords (which is discouraged). Also, quoting the identifiers inconsistently may lead to a lot of case-sensitivity-related problems with some DMBS.
Using non-reserved names and no quoting is the preferred and most portable way of dealing with identifiers.