From 59523592c58abc303a6eae1904c80fa6a428c3d3 Mon Sep 17 00:00:00 2001
From: Rick Ellis <rick.ellis@ellislab.com>
Date: Fri, 17 Oct 2008 04:07:40 +0000
Subject: Fixed a number of bug reports related to table/db names not being
 escaped or prefixed correctly.

---
 system/database/drivers/oci8/oci8_driver.php | 109 ++++++---------------------
 1 file changed, 23 insertions(+), 86 deletions(-)

(limited to 'system/database/drivers/oci8/oci8_driver.php')

diff --git a/system/database/drivers/oci8/oci8_driver.php b/system/database/drivers/oci8/oci8_driver.php
index 006e6ef1f..0c51a5ea7 100644
--- a/system/database/drivers/oci8/oci8_driver.php
+++ b/system/database/drivers/oci8/oci8_driver.php
@@ -44,6 +44,9 @@
 class CI_DB_oci8_driver extends CI_DB {
 
 	var $dbdriver = 'oci8';
+	
+	// The character used for excaping
+	var $_escape_char = '"';
 
 	/**
 	 * The syntax to count rows is slightly different across different
@@ -419,7 +422,7 @@ class CI_DB_oci8_driver extends CI_DB {
 		if ($table == '')
 			return '0';
 
-		$query = $this->query($this->_count_string . $this->_protect_identifiers('numrows'). " FROM " . $this->_protect_identifiers($this->dbprefix.$table));
+		$query = $this->query($this->_count_string . $this->_protect_identifiers('numrows'). " FROM " . $this->_protect_identifiers($table, TRUE, NULL, FALSE));
 
 		if ($query == FALSE)
 			{
@@ -482,7 +485,7 @@ class CI_DB_oci8_driver extends CI_DB {
 	 */
 	function _field_data($table)
 	{
-		return "SELECT * FROM ".$this->_escape_table($table)." where rownum = 1";
+		return "SELECT * FROM ".$table." where rownum = 1";
 	}
 
 	// --------------------------------------------------------------------
@@ -516,102 +519,34 @@ class CI_DB_oci8_driver extends CI_DB {
 	// --------------------------------------------------------------------
 
 	/**
-	 * Escape Column Name
+	 * Escape the SQL Identifiers
 	 *
-	 * This function adds backticks around supplied column name
+	 * This function escapes column and table names
 	 *
 	 * @access	private
-	 * @param	string	the column name
+	 * @param	string
 	 * @return	string
 	 */
-	function _escape_column($column)
+	function _escape_identifiers($item)
 	{
-		// Probably not necessary with Oracle so we simply return the value
-		return $column;
-	}
-
-	// --------------------------------------------------------------------
-
-	/**
-	 * Escape Table Name
-	 *
-	 * This function adds backticks if the table name has a period
-	 * in it. Some DBs will get cranky unless periods are escaped
-	 *
-	 * @access  private
-	 * @param   string  the table name
-	 * @return  string
-	 */
-	function _escape_table($table)
-	{
-		if (strpos($table, '.') !== FALSE)
+		if ($this->_escape_char == '')
 		{
-			$table = '"' . str_replace('.', '"."', $table) . '"';
+			return $item;
 		}
-
-		return $table;
-	}
-
-	// --------------------------------------------------------------------
-
-	/**
-	 * Protect Identifiers
-	 *
-	 * This function adds backticks if appropriate based on db type
-	 *
-	 * @access	private
-	 * @param	mixed	the item to escape
-	 * @param	boolean	only affect the first word
-	 * @return	mixed	the item with backticks
-	 */
-	function _protect_identifiers($item, $first_word_only = FALSE)
-	{
-		if (is_array($item))
-		{
-			$escaped_array = array();
-
-			foreach($item as $k=>$v)
-			{
-				$escaped_array[$this->_protect_identifiers($k)] = $this->_protect_identifiers($v, $first_word_only);
-			}
-
-			return $escaped_array;
-		}	
-
-		// This function may get "item1 item2" as a string, and so
-		// we may need ""item1" "item2"" and not ""item1 item2""
-		if (ctype_alnum($item) === FALSE)
+	
+		if (strpos($item, '.') !== FALSE)
 		{
-			if (strpos($item, '.') !== FALSE)
-			{
-				$aliased_tables = implode(".",$this->ar_aliased_tables).'.';
-				$table_name =  substr($item, 0, strpos($item, '.')+1);
-				$item = (strpos($aliased_tables, $table_name) !== FALSE) ? $item = $item : $this->dbprefix.$item;
-			}
-
-			// This function may get "field >= 1", and need it to return ""field" >= 1"
-			$lbound = ($first_word_only === TRUE) ? '' : '|\s|\(';
-
-			$item = preg_replace('/(^'.$lbound.')([\w\d\-\_]+?)(\s|\)|$)/iS', '$1"$2"$3', $item);
+			$str = $this->_escape_char.str_replace('.', $this->_escape_char.'.'.$this->_escape_char, $item).$this->_escape_char;			
 		}
 		else
 		{
-			return "\"{$item}\"";
+			$str = $this->_escape_char.$item.$this->_escape_char;
 		}
-
-		$exceptions = array('AS', '/', '-', '%', '+', '*', 'OR', 'IS');
-		
-		foreach ($exceptions as $exception)
-		{
 		
-			if (stristr($item, " \"{$exception}\" ") !== FALSE)
-			{
-				$item = preg_replace('/ "('.preg_quote($exception).')" /i', ' $1 ', $item);
-			}
-		}
-		return $item;
+		// remove duplicates if the user already included the escape
+		return preg_replace('/['.$this->_escape_char.']+/', $this->_escape_char, $str);
 	}
-			
+	
 	// --------------------------------------------------------------------
 
 	/**
@@ -649,7 +584,7 @@ class CI_DB_oci8_driver extends CI_DB {
 	 */
 	function _insert($table, $keys, $values)
 	{
-	return "INSERT INTO ".$this->_escape_table($table)." (".implode(', ', $keys).") VALUES (".implode(', ', $values).")";
+	return "INSERT INTO ".$table." (".implode(', ', $keys).") VALUES (".implode(', ', $values).")";
 	}
 
 	// --------------------------------------------------------------------
@@ -678,8 +613,10 @@ class CI_DB_oci8_driver extends CI_DB {
 		
 		$orderby = (count($orderby) >= 1)?' ORDER BY '.implode(", ", $orderby):'';
 	
-		$sql = "UPDATE ".$this->_escape_table($table)." SET ".implode(', ', $valstr);
+		$sql = "UPDATE ".$table." SET ".implode(', ', $valstr);
+
 		$sql .= ($where != '' AND count($where) >=1) ? " WHERE ".implode(" ", $where) : '';
+
 		$sql .= $orderby.$limit;
 		
 		return $sql;
@@ -700,7 +637,7 @@ class CI_DB_oci8_driver extends CI_DB {
 	 */	
 	function _truncate($table)
 	{
-		return "TRUNCATE TABLE ".$this->_escape_table($table);
+		return "TRUNCATE TABLE ".$table;
 	}
 	
 	// --------------------------------------------------------------------
-- 
cgit v1.2.3-24-g4f1b