Index: tests/Zend/Db/Statement/MysqliTest.php IDEA additional info: Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP <+>UTF-8 =================================================================== --- tests/Zend/Db/Statement/MysqliTest.php (revision 24709) +++ tests/Zend/Db/Statement/MysqliTest.php (revision ) @@ -21,7 +21,18 @@ */ require_once 'Zend/Db/Statement/TestCommon.php'; +require_once 'Zend/Db/Statement/Mysqli.php'; +/** + * Wrapper class for test protected function _stripQuoted + */ +class Zend_Db_Statement_Mysqli_Test_Class extends Zend_Db_Statement_Mysqli +{ + public function stripQuoted($sql) + { + return $this->_stripQuoted($sql); + } +} /** * @category Zend @@ -34,7 +45,111 @@ */ class Zend_Db_Statement_MysqliTest extends Zend_Db_Statement_TestCommon { + protected $_Zend_Db_Statement_Mysqli_Test_Class = null; + /** + * @group ZF-7911 + */ + public function testStripQuoted() + { + $this->_Zend_Db_Statement_Mysqli_Test_Class = new Zend_Db_Statement_Mysqli_Test_Class($this->_db, "SELECT 1"); + + $input = <<_Zend_Db_Statement_Mysqli_Test_Class->stripQuoted($in); + $this->assertSame($out, $actual, $count . ' - unexpected output'); + } + } - + public function testStatementRowCount() { $products = $this->_db->quoteIdentifier('zfproducts'); Index: library/Zend/Db/Statement.php IDEA additional info: Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP <+>UTF-8 =================================================================== --- library/Zend/Db/Statement.php (revision 24709) +++ library/Zend/Db/Statement.php (revision ) @@ -176,37 +176,37 @@ */ protected function _stripQuoted($sql) { - // get the character for delimited id quotes, - // this is usually " but in MySQL is ` - $d = $this->_adapter->quoteIdentifier('a'); - $d = $d[0]; - // get the value used as an escaped delimited id quote, - // e.g. \" or "" or \` - $de = $this->_adapter->quoteIdentifier($d); - $de = substr($de, 1, 2); - $de = str_replace('\\', '\\\\', $de); - // get the character for value quoting // this should be ' $q = $this->_adapter->quote('a'); - $q = $q[0]; + $q = $q[0]; - // get the value used as an escaped quote, // e.g. \' or '' $qe = $this->_adapter->quote($q); $qe = substr($qe, 1, 2); - $qe = str_replace('\\', '\\\\', $qe); + $qe = preg_quote($qe); + // remove 'foo\'bar' + if (!empty($q)) { + $sql = preg_replace("/$q($qe|[^$q])*$q/Us", '', $sql); + } - + // get a version of the SQL statement with all quoted // values and delimited identifiers stripped out // remove "foo\"bar" - $sql = preg_replace("/$q($qe|\\\\{2}|[^$q])*$q/", '', $sql); - // remove 'foo\'bar' - if (!empty($q)) { - $sql = preg_replace("/$q($qe|[^$q])*$q/", '', $sql); - } + $sql = preg_replace("/\"(\\\\\"|[^\"])*\"/Us", '', $sql); + // get the character for delimited id quotes, + // this is usually " but in MySQL is ` + $d = $this->_adapter->quoteIdentifier('a'); + $d = $d[0]; + // get the value used as an escaped delimited id quote, + // e.g. \" or "" or \` + $de = $this->_adapter->quoteIdentifier($d); + $de = substr($de, 1, 2); + $de = preg_quote($de); + // Note: $de and $d where never used..., now they are: + $sql = preg_replace("/$d($de|\\\\{2}|[^$d])*$d/Us", '', $sql); return $sql; }