fix: always escape identifiers in insertBatch()

codeigniter4 · Sep 26, 2021 · 5427050 · 5427050
1 parent 2b40f0e
commit 5427050
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 2 deletions.
diff --git a/system/Database/BaseBuilder.php b/system/Database/BaseBuilder.php
@@ -1604,7 +1604,7 @@ public function insertBatch(?array $set = null, ?bool $escape = null, int $batch
         $affectedRows = 0;
 
         for ($i = 0, $total = count($this->QBSet); $i < $total; $i += $batchSize) {
-            $sql = $this->_insertBatch($this->db->protectIdentifiers($table, true, $escape, false), $this->QBKeys, array_slice($this->QBSet, $i, $batchSize));
+            $sql = $this->_insertBatch($this->db->protectIdentifiers($table, true, null, false), $this->QBKeys, array_slice($this->QBSet, $i, $batchSize));
 
             if ($this->testMode) {
                 $affectedRows++;
@@ -1672,7 +1672,7 @@ public function setInsertBatch($key, string $value = '', ?bool $escape = null)
         }
 
         foreach ($keys as $k) {
-            $this->QBKeys[] = $this->db->protectIdentifiers($k, false, $escape);
+            $this->QBKeys[] = $this->db->protectIdentifiers($k, false);
         }
 
         return $this;

diff --git a/tests/system/Database/Builder/InsertTest.php b/tests/system/Database/Builder/InsertTest.php
@@ -98,6 +98,36 @@ public function testInsertBatch()
         $this->assertSame($expected, str_replace("\n", ' ', $query->getQuery()));
     }
 
+    public function testInsertBatchWithoutEscape()
+    {
+        $builder = $this->db->table('jobs');
+
+        $insertData = [
+            [
+                'id'          => 2,
+                'name'        => '1 + 1',
+                'description' => '1 + 2',
+            ],
+            [
+                'id'          => 3,
+                'name'        => '2 + 1',
+                'description' => '2 + 2',
+            ],
+        ];
+
+        $this->db->shouldReturn('execute', 1)->shouldReturn('affectedRows', 1);
+        $builder->insertBatch($insertData, false);
+
+        $query = $this->db->getLastQuery();
+        $this->assertInstanceOf(Query::class, $query);
+
+        $raw = 'INSERT INTO "jobs" ("description", "id", "name") VALUES (:description:,:id:,:name:), (:description.1:,:id.1:,:name.1:)';
+        $this->assertSame($raw, str_replace("\n", ' ', $query->getOriginalQuery()));
+
+        $expected = "INSERT INTO \"jobs\" (\"description\", \"id\", \"name\") VALUES (1 + 2,2,1 + 1), (2 + 2,3,2 + 1)";
+        $this->assertSame($expected, str_replace("\n", ' ', $query->getQuery()));
+    }
+
     /**
      * @see https://github.com/codeigniter4/CodeIgniter4/issues/4345
      */