From c1059875bce7bd8f66a634f4a0c040f988442f2a Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 21 Jun 2018 19:48:25 +0000 Subject: [PATCH 1/5] This fixes the problem with mixed variables in queries --- include/dba.php | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/include/dba.php b/include/dba.php index 478a1a10c2..17234f02b3 100644 --- a/include/dba.php +++ b/include/dba.php @@ -171,7 +171,7 @@ class dba { */ public static function database_name() { $ret = self::p("SELECT DATABASE() AS `db`"); - $data = self::inArray($ret); + $data = self::inArray($ret); return $data[0]['db']; } @@ -1296,6 +1296,33 @@ class dba { $condition_string .= " AND "; } if (is_array($value)) { + // Check if there are integer values in the parameters + $is_int = false; + $is_alpha = false; + foreach ($value as $single_value) { + if (is_int($single_value)) { + $is_int = true; + } + + // Is any non numeric value present? + if (!is_numeric($single_value)) { + $is_alpha = true; + } + } + + // Cast them all in an unique method + if ($is_int) { + $casted = []; + foreach ($value as $single_value) { + if ($is_int AND !$is_alpha) { + $casted[] = (int)$single_value; + } else { + $casted[] = (string)$single_value; + } + } + $value = $casted; + } + $new_values = array_merge($new_values, array_values($value)); $placeholders = substr(str_repeat("?, ", count($value)), 0, -2); $condition_string .= "`" . $field . "` IN (" . $placeholders . ")"; From 5656c0564afef720b427b34c857d7d96e65a75ad Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 21 Jun 2018 19:52:28 +0000 Subject: [PATCH 2/5] We don't need to look $is_int there --- include/dba.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/dba.php b/include/dba.php index 17234f02b3..47471ae952 100644 --- a/include/dba.php +++ b/include/dba.php @@ -1314,7 +1314,7 @@ class dba { if ($is_int) { $casted = []; foreach ($value as $single_value) { - if ($is_int AND !$is_alpha) { + if (!$is_alpha) { $casted[] = (int)$single_value; } else { $casted[] = (string)$single_value; From 261d7435c01348a59ea590442e15c00a0bfafdf5 Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 21 Jun 2018 20:33:27 +0000 Subject: [PATCH 3/5] Check for floats and enable native prepares --- include/dba.php | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/include/dba.php b/include/dba.php index 47471ae952..847d1f0b5f 100644 --- a/include/dba.php +++ b/include/dba.php @@ -76,6 +76,8 @@ class dba { } try { self::$db = @new PDO($connect, $user, $pass); + self::$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); + self::$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, false); self::$connected = true; } catch (PDOException $e) { } @@ -1298,12 +1300,18 @@ class dba { if (is_array($value)) { // Check if there are integer values in the parameters $is_int = false; + $is_float = false; $is_alpha = false; foreach ($value as $single_value) { if (is_int($single_value)) { $is_int = true; } + // To prevent to round floats we look for them + if (is_float($single_value)) { + $is_float = true; + } + // Is any non numeric value present? if (!is_numeric($single_value)) { $is_alpha = true; @@ -1314,7 +1322,7 @@ class dba { if ($is_int) { $casted = []; foreach ($value as $single_value) { - if (!$is_alpha) { + if (!$is_alpha && !$is_float) { $casted[] = (int)$single_value; } else { $casted[] = (string)$single_value; From 1b85b75563d46e70fb355c4028b0ffc1701828c6 Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 21 Jun 2018 20:42:58 +0000 Subject: [PATCH 4/5] Currently removed, needs more testing --- include/dba.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/include/dba.php b/include/dba.php index 847d1f0b5f..6e399e5de4 100644 --- a/include/dba.php +++ b/include/dba.php @@ -76,8 +76,9 @@ class dba { } try { self::$db = @new PDO($connect, $user, $pass); - self::$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); - self::$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, false); + // Needs more testing + //self::$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); + //self::$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, false); self::$connected = true; } catch (PDOException $e) { } From e1e28ba7c3a97fc06ca46486cd6bcebb45b71ff7 Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 21 Jun 2018 21:55:43 +0000 Subject: [PATCH 5/5] Better float detection --- include/dba.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/dba.php b/include/dba.php index 6e399e5de4..38760a6c9e 100644 --- a/include/dba.php +++ b/include/dba.php @@ -1309,7 +1309,7 @@ class dba { } // To prevent to round floats we look for them - if (is_float($single_value)) { + if (round($single_value) != (float)$single_value) { $is_float = true; }