From 8c4057b095eb96204dedf78e538ab39805b16662 Mon Sep 17 00:00:00 2001
From: Kamil Tekiela <tekiela246@gmail.com>
Date: Mon, 3 Apr 2023 17:34:54 +0100
Subject: [PATCH] Use quoteString in Tracking

Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
---
 libraries/classes/Tracking/Tracking.php | 17 +++++++++--------
 phpstan-baseline.neon                   |  4 ++--
 psalm-baseline.xml                      | 11 +----------
 3 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/libraries/classes/Tracking/Tracking.php b/libraries/classes/Tracking/Tracking.php
index 54ffe9a97d..1254394cc3 100644
--- a/libraries/classes/Tracking/Tracking.php
+++ b/libraries/classes/Tracking/Tracking.php
@@ -11,6 +11,7 @@ use DateTimeImmutable;
 use PhpMyAdmin\ConfigStorage\Relation;
 use PhpMyAdmin\Core;
 use PhpMyAdmin\DatabaseInterface;
+use PhpMyAdmin\Dbal\Connection;
 use PhpMyAdmin\Dbal\ResultInterface;
 use PhpMyAdmin\Html\Generator;
 use PhpMyAdmin\Message;
@@ -99,11 +100,11 @@ class Tracking
         }
 
         $query = sprintf(
-            'SELECT * FROM %s.%s WHERE db_name = \'%s\' AND table_name = \'%s\' ORDER BY version DESC',
+            'SELECT * FROM %s.%s WHERE db_name = %s AND table_name = %s ORDER BY version DESC',
             Util::backquote($trackingFeature->database),
             Util::backquote($trackingFeature->tracking),
-            $this->dbi->escapeString($db),
-            $this->dbi->escapeString($table),
+            $this->dbi->quoteString($db, Connection::TYPE_CONTROL),
+            $this->dbi->quoteString($table, Connection::TYPE_CONTROL),
         );
 
         return $this->dbi->queryAsControlUser($query);
@@ -1026,8 +1027,8 @@ class Tracking
         // Prepare statement to get HEAD version
         $allTablesQuery = ' SELECT table_name, MAX(version) as version FROM '
             . Util::backquote($trackingFeature->database) . '.' . Util::backquote($trackingFeature->tracking)
-            . ' WHERE db_name = \'' . $this->dbi->escapeString($db)
-            . '\'  GROUP BY table_name ORDER BY table_name ASC';
+            . ' WHERE db_name = ' . $this->dbi->quoteString($db, Connection::TYPE_CONTROL)
+            . '  GROUP BY table_name ORDER BY table_name ASC';
 
         $allTablesResult = $this->dbi->queryAsControlUser($allTablesQuery);
         $untrackedTables = $this->trackingChecker->getUntrackedTableNames($db);
@@ -1038,9 +1039,9 @@ class Tracking
             [$tableName, $versionNumber] = $oneResult;
             $tableQuery = ' SELECT * FROM '
                 . Util::backquote($trackingFeature->database) . '.' . Util::backquote($trackingFeature->tracking)
-                . ' WHERE `db_name` = \'' . $this->dbi->escapeString($db)
-                . '\' AND `table_name`  = \'' . $this->dbi->escapeString($tableName)
-                . '\' AND `version` = \'' . $versionNumber . '\'';
+                . ' WHERE `db_name` = ' . $this->dbi->quoteString($db, Connection::TYPE_CONTROL)
+                . ' AND `table_name`  = ' . $this->dbi->quoteString($tableName, Connection::TYPE_CONTROL)
+                . ' AND `version` = ' . $this->dbi->quoteString($versionNumber, Connection::TYPE_CONTROL);
 
             $versions[] = $this->dbi->queryAsControlUser($tableQuery)->fetchAssoc();
         }
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
index cae923b62f..dbc23d5874 100644
--- a/phpstan-baseline.neon
+++ b/phpstan-baseline.neon
@@ -8826,8 +8826,8 @@ parameters:
 			path: libraries/classes/Tracking/Tracking.php
 
 		-
-			message: "#^Parameter \\#1 \\$str of method PhpMyAdmin\\\\DatabaseInterface\\:\\:escapeString\\(\\) expects string, string\\|null given\\.$#"
-			count: 1
+			message: "#^Parameter \\#1 \\$str of method PhpMyAdmin\\\\DatabaseInterface\\:\\:quoteString\\(\\) expects string, string\\|null given\\.$#"
+			count: 2
 			path: libraries/classes/Tracking/Tracking.php
 
 		-
diff --git a/psalm-baseline.xml b/psalm-baseline.xml
index f6c6dea008..ac07d50c4d 100644
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -13657,13 +13657,6 @@
     </PossiblyUnusedMethod>
   </file>
   <file src="libraries/classes/Tracking/Tracking.php">
-    <DeprecatedMethod>
-      <code>escapeString</code>
-      <code>escapeString</code>
-      <code>escapeString</code>
-      <code>escapeString</code>
-      <code>escapeString</code>
-    </DeprecatedMethod>
     <MixedArgument>
       <code>$columns</code>
       <code>$data[$whichLog]</code>
@@ -13743,10 +13736,8 @@
     <PossiblyNullArgument>
       <code><![CDATA[$data['schema_snapshot']]]></code>
       <code>$tableName</code>
-    </PossiblyNullArgument>
-    <PossiblyNullOperand>
       <code>$versionNumber</code>
-    </PossiblyNullOperand>
+    </PossiblyNullArgument>
     <PossiblyUndefinedArrayOffset>
       <code><![CDATA[$data['ddlog']]]></code>
       <code><![CDATA[$data['schema_snapshot']]]></code>