PHP-MySQLi-Database-Class
PHP-MySQLi-Database-Class copied to clipboard
Prefix not added to all table names in rawQuery ?
$db->new MySqliDB('root','password','database','prefix_demo_');
$db->rawQuery(
"SELECT col1, col2 FROM tbl_accounts
UNION
SELECT col3, col4 FROM tbl_jobcards
UNION
SELECT col5, col6 FROM tbl_purcsale ");
And my table prefix is prefix_demo_
Now it is only adding prefix to tbl_accounts table only.
How can I resolve this ?
The rawAddPrefix
function has many bugs, first thing is that only the first table in the query gets prefixed, (so if using query with a JOIN
clause for example only first table will get prefixed), also a lot of statements such as (DROP TABLE
, TRUNCATE TABLE
, CREATE TABLE
, LOCK TABLE
, FLASHBACK TABLE
, ALTER TABLE
, ANALYZE TABLE
, DESCRIBE
and EXPLAIN
) are not supported ..
You can fix all these bug by replacing that function with mines:
/**
* Prefix add raw SQL query.
*
* @author Mohamed Riyad <https://github.com/RyadPasha>
* @param string $query User-provided query to execute.
* @return string Contains the returned rows from the query.
*/
public function rawAddPrefix($query){
$query = preg_replace(['/[\r\n]+/', '/\s+/'], ' ', $query); // Replace multiple line breaks/spaces with a single space
if (preg_match_all("/(FROM|INTO|UPDATE|JOIN|DROP TABLE|TRUNCATE TABLE|CREATE TABLE|LOCK TABLE|FLASHBACK TABLE|ALTER TABLE|ANALYZE TABLE|DESCRIBE|EXPLAIN) [\\'\\´\\`]?(?!SELECT|DELETE|INSERT|REPLACE|UPDATE)([a-zA-Z0-9_-]+)[\\'\\´\\`]?/i", $query, $matches)) {
for ($i = 0; $i < count($matches[0]); $i++) {
list($from_table, $from, $table) = $matches;
$query = str_replace($table[$i], self::$prefix.$table[$i], $query);
}
}
return $query;
}