Pgsql, Sqlite and Static selects need quotes

zendframework · Jun 14, 2014 · 005bd71 · 005bd71
1 parent 187db6c
commit 005bd71
Show file tree

Hide file tree

Showing 6 changed files with 66 additions and 0 deletions.
diff --git a/tests/Zend/Db/Select/Pdo/PgsqlTest.php b/tests/Zend/Db/Select/Pdo/PgsqlTest.php
@@ -126,4 +126,15 @@ public function testSelectFromSchemaInNameOverridesSchemaArgument()
 
         $this->assertEquals(4, count($rowset));
     }
+
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
 }
diff --git a/tests/Zend/Db/Select/Pdo/SqliteTest.php b/tests/Zend/Db/Select/Pdo/SqliteTest.php
@@ -174,4 +174,15 @@ public function getDriver()
         return 'Pdo_Sqlite';
     }
 
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
+
 }
diff --git a/tests/Zend/Db/Select/StaticTest.php b/tests/Zend/Db/Select/StaticTest.php
@@ -820,4 +820,15 @@ public function getDriver()
     {
         return 'Static';
     }
+
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
 }
diff --git a/tests/Zend/Db/Table/Select/Pdo/PgsqlTest.php b/tests/Zend/Db/Table/Select/Pdo/PgsqlTest.php
@@ -130,4 +130,15 @@ protected function _selectColumnWithColonQuotedParameter ()
                             ->where($product_name . ' = ?', "as'as:x");
         return $select;
     }
+
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
  }
diff --git a/tests/Zend/Db/Table/Select/Pdo/SqliteTest.php b/tests/Zend/Db/Table/Select/Pdo/SqliteTest.php
@@ -178,4 +178,15 @@ public function getDriver()
         return 'Pdo_Sqlite';
     }
 
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
+
 }
diff --git a/tests/Zend/Db/Table/Select/StaticTest.php b/tests/Zend/Db/Table/Select/StaticTest.php
@@ -697,4 +697,15 @@ public function getDriver()
         return 'Static';
     }
 
+    public function testSqlInjectionWithOrder()
+    {
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('MD5(1);select');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "MD5(1);select" ASC', $select->assemble());
+
+        $select = $this->_db->select();
+        $select->from(array('p' => 'products'))->order('name;select;MD5(1)');
+        $this->assertEquals('SELECT "p".* FROM "products" AS "p" ORDER BY "name;select;MD5(1)" ASC', $select->assemble());
+    }
+
 }