Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exception with single quote literal #453

Open
tstauer opened this issue Jan 13, 2025 · 0 comments
Open

Exception with single quote literal #453

tstauer opened this issue Jan 13, 2025 · 0 comments

Comments

@tstauer
Copy link

tstauer commented Jan 13, 2025

Hi there,
I'm getting an error when a user supplies a single quote in my query.
My believe is that qomf->literal should escape the user input.

I'm using PHPCR with jackalope-doctrine-dbal and Symfony.

Here's my sample code:

use PHPCR\Query\QOM\QueryObjectModelFactoryInterface;
use PHPCR\Util\QOM\QueryBuilder;

        $jobId  = "'";
        $locale = 'de'
        $queryBuilder = new QueryBuilder($this->qomFactory);
        $qomf         = $queryBuilder->qomf();
        $queryBuilder->from(
            $qomf->selector('a', 'nt:unstructured')
        );
        $queryBuilder->where(
            $qomf->comparison(
                $qomf->propertyValue(
                    'a',
                    $this->propertyEncoder->localizedContentName('JobID', $locale)
                ),
                QueryObjectModelFactoryInterface::JCR_OPERATOR_EQUAL_TO,
                $qomf->literal($jobId)
            )
        );
        $qomQuery = $queryBuilder->getQuery();
        $queryBuilder->setMaxResults(1);
        $result = $queryBuilder->execute();

This is my error message:
An exception occurred while executing a query: SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ')]) > 0'

I'm using these dependencies:

  • jackalope/jackalope-doctrine-dbal 2.0.2
  • jackalope/jackalope-jackrabbit 2.0.0
  • doctrine/dbal 3.9.3

I found this:

Could it be that https://github.com/jackalope/jackalope-doctrine-dbal/blob/2.0.2/src/Jackalope/Transport/DoctrineDBAL/Query/QOMWalker.php walkComparisonConstraint needs to escape single quotes?

Am I missing something here?
Thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant