Replace escapeString with quoteString in ImportController

MauricioFauth · MauricioFauth · commit de9884f56298 · 2022-11-12T11:42:09.000-03:00
Signed-off-by: Maurício Meneghini Fauth &lt;mauricio@fauth.dev&gt;
diff --git a/libraries/classes/Controllers/Import/ImportController.php b/libraries/classes/Controllers/Import/ImportController.php
@@ -139,10 +139,11 @@ public function __invoke(ServerRequest $request): void
         if (! empty($GLOBALS['sql_query'])) {
             // apply values for parameters
             if (! empty($_POST['parameterized']) && ! empty($_POST['parameters']) && is_array($_POST['parameters'])) {
+                /** @var array<string, string> $parameters */
                 $parameters = $_POST['parameters'];
                 foreach ($parameters as $parameter => $replacementValue) {
                     if (! is_numeric($replacementValue)) {
-                        $replacementValue = '\'' . $this->dbi->escapeString($replacementValue) . '\'';
+                        $replacementValue = $this->dbi->quoteString($replacementValue);
                     }
 
                     $quoted = preg_quote($parameter, '/');
diff --git a/psalm-baseline.xml b/psalm-baseline.xml
@@ -2207,9 +2207,6 @@
     </UnusedVariable>
   </file>
   <file src="libraries/classes/Controllers/Import/ImportController.php">
-    <DeprecatedMethod occurrences="1">
-      <code>escapeString</code>
-    </DeprecatedMethod>
     <DocblockTypeContradiction occurrences="1">
       <code>$import_plugin == null</code>
     </DocblockTypeContradiction>
@@ -2272,26 +2269,23 @@
     <MixedMethodCall occurrences="1">
       <code>close</code>
     </MixedMethodCall>
-    <PossiblyInvalidArgument occurrences="10">
+    <PossiblyInvalidArgument occurrences="8">
       <code>$GLOBALS['format']</code>
       <code>$GLOBALS['local_import_file']</code>
       <code>$_POST['bkm_label']</code>
       <code>$_POST['bkm_label']</code>
       <code>$_POST['bookmark_variable']</code>
       <code>$_POST['sql_query']</code>
       <code>$_POST['sql_query']</code>
-      <code>$parameter</code>
-      <code>$replacement</code>
       <code>$skip &lt; $GLOBALS['read_limit'] ? $skip : $GLOBALS['read_limit']</code>
     </PossiblyInvalidArgument>
-    <PossiblyInvalidCast occurrences="7">
+    <PossiblyInvalidCast occurrences="6">
       <code>$GLOBALS['format']</code>
       <code>$GLOBALS['local_import_file']</code>
       <code>$_POST['bkm_label']</code>
       <code>$_POST['bkm_label']</code>
       <code>$_POST['sql_query']</code>
       <code>$_POST['sql_query']</code>
-      <code>$replacement</code>
     </PossiblyInvalidCast>
     <PossiblyInvalidOperand occurrences="3">
       <code>$GLOBALS['charset_of_file']</code>
@@ -9867,8 +9861,7 @@
     </PossiblyNullArgument>
   </file>
   <file src="libraries/classes/Plugins/Export/ExportSql.php">
-    <DeprecatedMethod occurrences="10">
-      <code>escapeString</code>
+    <DeprecatedMethod occurrences="9">
       <code>escapeString</code>
       <code>escapeString</code>
       <code>escapeString</code>
