[#ZF-3512] Improper handling of unsigned int values in quote() - Zend Framework Issue Tracker

Zend Framework

Improper handling of unsigned int values in quote()

Created: 25/Jun/08 01:48 PM Updated: 26/Feb/10 03:25 AM

Component/s:

Zend_Db_Adapter_Mysqli

Affects Version/s:

1.5.1, 1.5.2

Fix Version/s:

None

Time Tracking:

Original Estimate:

Not Specified

Remaining Estimate:

1 hour

Time Spent:

3 hours

File Attachments:

ZF-3512-TESTS.patch (3 kB)
2.

ZF-3512.patch (22 kB)

Description

« Hide

The default quote() method of the parent class (Zend_Db_Adapter_Abstract) uses the following cast operations to ensure that the value is a valid 32-bit integer.

case Zend_Db::INT_TYPE: // 32-bit integer
return (string) intval($value);
break;

This works for signed integers, but for fields declared as UNSIGNED in MySQL, this turns valid values between 2147483648 and 4294967296 into '2147483647'.

Sort Order:

[ Permalink | « Hide ]

Maghiel Dijksman added a comment - 06/Feb/10 06:58 PM

I think a possible solution would be to add Zend_Db::UNSIGNED_TYPE type,
add
case Zend_Db::UNSIGNED_TYPE: // Unsigned integer
$quotedValue = sprintf('%u', $value);
break;
to Zend_Db_Adapter_Abstract::quote()

and implement in all adapters.

Ralph if you want I can write a patch, i'm almost done with it, but time for bed now.

[ Permalink | « Hide ]

Maghiel Dijksman added a comment - 09/Feb/10 07:10 PM

Here's a patch. Passes all current unit tests.

UNSIGNED_TYPE might not be the best name for the constant,
as this patch only implements integers as unsigned types. But would extending it
to other datatypes be necessary? Maybe for consequence and completeness sake...

Am I taking the right actions to take on bugs like this?
If not, someone please slap me

If this is the right way and this patch is ok, I'll write tests for it tomorrow!
Let me know

[ Permalink | « Hide ]

Maghiel Dijksman added a comment - 09/Feb/10 07:26 PM

I looked at the activity log and it didn't really look like anyone was working on this? So I took the liberty of assigning it to myself. Someone please review!

[ Permalink | « Hide ]

Maghiel Dijksman added a comment - 14/Feb/10 07:07 PM

Tests

[ Permalink | « Hide ]

Maghiel Dijksman added a comment - 14/Feb/10 07:08 PM

Please review

[ Permalink | « Hide ]

Holger Schletz added a comment - 25/Feb/10 12:32 AM

Unsigned integers are not part of the SQL standard and not available on all DBMS. How will this patch affect compatibility with DBMS that don't support it, like PostgreSQL? Is it wise to implement it in their respective adapters?

[ Permalink | « Hide ]

Mickael Perraud added a comment - 25/Feb/10 07:37 AM

Why this issue is 'Fixed' as there is no associated SVN commit?

[ Permalink | « Hide ]

Maghiel Dijksman added a comment - 25/Feb/10 12:09 PM

Sorry guys, I was confused with the workflow of my work when I put the status of this issue to Resolved.