Skip to content

Commit 3a56e51

Browse files
kamil-tekielaMauricioFauth
kamil-tekiela
authored and
MauricioFauth
committed
Replace escapeString with quoteString
Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
1 parent 7e5d96b commit 3a56e51

4 files changed

Lines changed: 28 additions & 29 deletions

File tree

‎libraries/classes/UserPreferences.php‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -100,9 +100,8 @@ public function load(): array
100100
. Util::backquote($relationParameters->userPreferencesFeature->userConfig);
101101
$query = 'SELECT `config_data`, UNIX_TIMESTAMP(`timevalue`) ts'
102102
. ' FROM ' . $query_table
103-
. ' WHERE `username` = \''
104-
. $this->dbi->escapeString((string) $relationParameters->user)
105-
. '\'';
103+
. ' WHERE `username` = '
104+
. $this->dbi->quoteString((string) $relationParameters->user);
106105
$row = $this->dbi->fetchSingleRow(
107106
$query,
108107
DatabaseInterface::FETCH_ASSOC,
@@ -154,26 +153,23 @@ public function save(array $config_array)
154153
$query_table = Util::backquote($relationParameters->userPreferencesFeature->database) . '.'
155154
. Util::backquote($relationParameters->userPreferencesFeature->userConfig);
156155
$query = 'SELECT `username` FROM ' . $query_table
157-
. ' WHERE `username` = \''
158-
. $this->dbi->escapeString($relationParameters->user)
159-
. '\'';
156+
. ' WHERE `username` = '
157+
. $this->dbi->quoteString($relationParameters->user);
160158

161159
$has_config = $this->dbi->fetchValue($query, 0, Connection::TYPE_CONTROL);
162160
$config_data = json_encode($config_array);
163161
if ($has_config) {
164162
$query = 'UPDATE ' . $query_table
165-
. ' SET `timevalue` = NOW(), `config_data` = \''
166-
. $this->dbi->escapeString($config_data)
167-
. '\''
168-
. ' WHERE `username` = \''
169-
. $this->dbi->escapeString($relationParameters->user)
170-
. '\'';
163+
. ' SET `timevalue` = NOW(), `config_data` = '
164+
. $this->dbi->quoteString($config_data)
165+
. ' WHERE `username` = '
166+
. $this->dbi->quoteString($relationParameters->user);
171167
} else {
172168
$query = 'INSERT INTO ' . $query_table
173169
. ' (`username`, `timevalue`,`config_data`) '
174-
. 'VALUES (\''
175-
. $this->dbi->escapeString($relationParameters->user) . '\', NOW(), '
176-
. '\'' . $this->dbi->escapeString($config_data) . '\')';
170+
. 'VALUES ('
171+
. $this->dbi->quoteString($relationParameters->user) . ', NOW(), '
172+
. $this->dbi->quoteString($config_data) . ')';
177173
}
178174

179175
if (isset($_SESSION['cache'][$cache_key]['userprefs'])) {

‎phpstan-baseline.neon‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8940,6 +8940,11 @@ parameters:
89408940
count: 1
89418941
path: libraries/classes/UserPreferences.php
89428942

8943+
-
8944+
message: "#^Parameter \\#1 \\$str of method PhpMyAdmin\\\\DatabaseInterface\\:\\:quoteString\\(\\) expects string, string\\|false given\\.$#"
8945+
count: 2
8946+
path: libraries/classes/UserPreferences.php
8947+
89438948
-
89448949
message: "#^Cannot use array destructuring on array\\|null\\.$#"
89458950
count: 1

‎psalm-baseline.xml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13374,14 +13374,6 @@
1337413374
</PossiblyInvalidCast>
1337513375
</file>
1337613376
<file src="libraries/classes/UserPreferences.php">
13377-
<DeprecatedMethod occurrences="6">
13378-
<code>escapeString</code>
13379-
<code>escapeString</code>
13380-
<code>escapeString</code>
13381-
<code>escapeString</code>
13382-
<code>escapeString</code>
13383-
<code>escapeString</code>
13384-
</DeprecatedMethod>
1338513377
<MixedArgumentTypeCoercion occurrences="2">
1338613378
<code>$path</code>
1338713379
<code>$url_params</code>

‎test/classes/UserPreferencesTest.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -114,8 +114,10 @@ public function testLoad(): void
114114
)
115115
);
116116
$dbi->expects($this->any())
117-
->method('escapeString')
118-
->will($this->returnArgument(0));
117+
->method('quoteString')
118+
->will($this->returnCallback(static function (string $string) {
119+
return "'" . $string . "'";
120+
}));
119121

120122
$userPreferences = new UserPreferences($dbi);
121123
$result = $userPreferences->load();
@@ -202,8 +204,10 @@ public function testSave(): void
202204
->will($this->returnValue(true));
203205

204206
$dbi->expects($this->any())
205-
->method('escapeString')
206-
->will($this->returnArgument(0));
207+
->method('quoteString')
208+
->will($this->returnCallback(static function (string $string) {
209+
return "'" . $string . "'";
210+
}));
207211

208212
$userPreferences = new UserPreferences($dbi);
209213
$result = $userPreferences->save([1]);
@@ -236,8 +240,10 @@ public function testSave(): void
236240
->with(Connection::TYPE_CONTROL)
237241
->will($this->returnValue('err1'));
238242
$dbi->expects($this->any())
239-
->method('escapeString')
240-
->will($this->returnArgument(0));
243+
->method('quoteString')
244+
->will($this->returnCallback(static function (string $string) {
245+
return "'" . $string . "'";
246+
}));
241247

242248
$userPreferences = new UserPreferences($dbi);
243249
$result = $userPreferences->save([1]);

0 commit comments

Comments
 (0)