Remove escapeString from Bookmark

This is changing the behaviour. The variable is no longer escaped. This can be documented for users to be aware, however, the users will most likely notice the change. The input now needs to be properly formatted part of SQL query.

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
This commit is contained in:
Kamil Tekiela 2024-01-09 03:28:59 +01:00
parent 5889920e91
commit a3db5915d8
3 changed files with 8 additions and 15 deletions

View File

@ -121,13 +121,8 @@ parameters:
path: src/Advisory/Advisor.php
-
message: "#^Construct empty\\(\\) is not allowed\\. Use more strict comparison\\.$#"
count: 1
path: src/Bookmarks/Bookmark.php
-
message: "#^Parameter \\#1 \\$str of method PhpMyAdmin\\\\DatabaseInterface\\:\\:escapeString\\(\\) expects string, mixed given\\.$#"
count: 1
message: "#^Parameter \\#2 \\$replace of function str_replace expects array\\|string, mixed given\\.$#"
count: 2
path: src/Bookmarks/Bookmark.php
-

View File

@ -40,12 +40,13 @@
</MixedAssignment>
</file>
<file src="src/Bookmarks/Bookmark.php">
<DeprecatedMethod>
<code>escapeString</code>
</DeprecatedMethod>
<MixedArgument>
<code>$variables[$i]</code>
<code>$var</code>
<code>$var</code>
</MixedArgument>
<MixedAssignment>
<code>$var</code>
</MixedAssignment>
<PossiblyUnusedMethod>
<code>getDatabase</code>
</PossiblyUnusedMethod>

View File

@ -137,10 +137,7 @@ class Bookmark
// replace variable placeholders with values
$numberOfVariables = $this->getVariableCount();
for ($i = 1; $i <= $numberOfVariables; $i++) {
$var = '';
if (! empty($variables[$i])) {
$var = $this->dbi->escapeString($variables[$i]);
}
$var = $variables[$i] ?? '';
$query = str_replace('[VARIABLE' . $i . ']', $var, $query);
// backward compatibility