From 59523592c58abc303a6eae1904c80fa6a428c3d3 Mon Sep 17 00:00:00 2001
From: Rick Ellis <rick.ellis@ellislab.com>
Date: Fri, 17 Oct 2008 04:07:40 +0000
Subject: Fixed a number of bug reports related to table/db names not being
 escaped or prefixed correctly.

---
 system/database/drivers/sqlite/sqlite_driver.php | 104 +++++------------------
 1 file changed, 22 insertions(+), 82 deletions(-)

(limited to 'system/database/drivers/sqlite/sqlite_driver.php')

diff --git a/system/database/drivers/sqlite/sqlite_driver.php b/system/database/drivers/sqlite/sqlite_driver.php
index df19dba78..0ba483f8b 100644
--- a/system/database/drivers/sqlite/sqlite_driver.php
+++ b/system/database/drivers/sqlite/sqlite_driver.php
@@ -33,6 +33,9 @@
 class CI_DB_sqlite_driver extends CI_DB {
 
 	var $dbdriver = 'sqlite';
+	
+	// The character used to escape with - not needed for SQLite
+	var $_escape_char = '';
 
 	/**
 	 * The syntax to count rows is slightly different across different
@@ -300,7 +303,7 @@ class CI_DB_sqlite_driver extends CI_DB {
 		if ($table == '')
 			return '0';
 	
-		$query = $this->query($this->_count_string . $this->_protect_identifiers('numrows'). " FROM " . $this->_protect_identifiers($this->dbprefix.$table));
+		$query = $this->query($this->_count_string . $this->_protect_identifiers('numrows'). " FROM " . $this->_protect_identifiers($table, TRUE, NULL, FALSE));
 		
 		if ($query->num_rows() == 0)
 			return '0';
@@ -361,7 +364,7 @@ class CI_DB_sqlite_driver extends CI_DB {
 	 */
 	function _field_data($table)
 	{
-		return "SELECT * FROM ".$this->_escape_table($table)." LIMIT 1";
+		return "SELECT * FROM ".$table." LIMIT 1";
 	}
 
 	// --------------------------------------------------------------------
@@ -393,97 +396,32 @@ class CI_DB_sqlite_driver extends CI_DB {
 	// --------------------------------------------------------------------
 
 	/**
-	 * Escape Column Name
-	 *
-	 * This function adds backticks around supplied column name
-	 *
-	 * @access	private
-	 * @param	string	the column name
-	 * @return	string
-	 */
-	function _escape_column($column)
-	{
-		// Not necessary with SQLite so we simply return the value
-		return $column;
-	}
-			
-	// --------------------------------------------------------------------
-
-	/**
-	 * Escape Table Name
+	 * Escape the SQL Identifiers
 	 *
-	 * This function adds backticks if the table name has a period
-	 * in it. Some DBs will get cranky unless periods are escaped
+	 * This function escapes column and table names
 	 *
 	 * @access	private
-	 * @param	string	the table name
+	 * @param	string
 	 * @return	string
 	 */
-	function _escape_table($table)
+	function _escape_identifiers($item)
 	{
-		// other database drivers use this to add backticks, hence this
-		// function is simply going to return the tablename for sqlite		
-		return $table;
-	}
-		
-	// --------------------------------------------------------------------
-
-	/**
-	 * Protect Identifiers
-	 *
-	 * This function adds backticks if appropriate based on db type
-	 *
-	 * @access	private
-	 * @param	mixed	the item to escape
-	 * @param	boolean	only affect the first word
-	 * @return	mixed	the item with backticks
-	 */
-	function _protect_identifiers($item, $first_word_only = FALSE)
-	{
-		if (is_array($item))
+		if ($this->_escape_char == '')
 		{
-			$escaped_array = array();
-
-			foreach($item as $k=>$v)
-			{
-				$escaped_array[$this->_protect_identifiers($k)] = $this->_protect_identifiers($v, $first_word_only);
-			}
-
-			return $escaped_array;
-		}	
-
-		// This function may get "item1 item2" as a string, and so
-		// we may need "item1 item2" and not "item1 item2"
-		if (ctype_alnum($item) === FALSE)
+			return $item;
+		}
+	
+		if (strpos($item, '.') !== FALSE)
 		{
-			if (strpos($item, '.') !== FALSE)
-			{
-				$aliased_tables = implode(".",$this->ar_aliased_tables).'.';
-				$table_name =  substr($item, 0, strpos($item, '.')+1);
-				$item = (strpos($aliased_tables, $table_name) !== FALSE) ? $item = $item : $this->dbprefix.$item;
-			}
-
-			// This function may get "field >= 1", and need it to return "field >= 1"
-			$lbound = ($first_word_only === TRUE) ? '' : '|\s|\(';
-
-			$item = preg_replace('/(^'.$lbound.')([\w\d\-\_]+?)(\s|\)|$)/iS', '$1$2$3', $item);
+			$str = $this->_escape_char.str_replace('.', $this->_escape_char.'.'.$this->_escape_char, $item).$this->_escape_char;			
 		}
 		else
 		{
-			return "{$item}";
+			$str = $this->_escape_char.$item.$this->_escape_char;
 		}
-
-		$exceptions = array('AS', '/', '-', '%', '+', '*', 'OR', 'IS');
-		
-		foreach ($exceptions as $exception)
-		{
 		
-			if (stristr($item, " {$exception} ") !== FALSE)
-			{
-				$item = preg_replace('/ ('.preg_quote($exception).') /i', ' $1 ', $item);
-			}
-		}
-		return $item;
+		// remove duplicates if the user already included the escape
+		return preg_replace('/['.$this->_escape_char.']+/', $this->_escape_char, $str);
 	}
 			
 	// --------------------------------------------------------------------
@@ -523,7 +461,7 @@ class CI_DB_sqlite_driver extends CI_DB {
 	 */
 	function _insert($table, $keys, $values)
 	{	
-		return "INSERT INTO ".$this->_escape_table($table)." (".implode(', ', $keys).") VALUES (".implode(', ', $values).")";
+		return "INSERT INTO ".$table." (".implode(', ', $keys).") VALUES (".implode(', ', $values).")";
 	}
 	
 	// --------------------------------------------------------------------
@@ -552,8 +490,10 @@ class CI_DB_sqlite_driver extends CI_DB {
 		
 		$orderby = (count($orderby) >= 1)?' ORDER BY '.implode(", ", $orderby):'';
 	
-		$sql = "UPDATE ".$this->_escape_table($table)." SET ".implode(', ', $valstr);
+		$sql = "UPDATE ".$table." SET ".implode(', ', $valstr);
+
 		$sql .= ($where != '' AND count($where) >=1) ? " WHERE ".implode(" ", $where) : '';
+
 		$sql .= $orderby.$limit;
 		
 		return $sql;
-- 
cgit v1.2.3-24-g4f1b