Use sprintf('%d') like in DB2, SQLServer and Oracle to harden against…

… wrong limit and offset Signed-off-by: Joas Schilling <coding@schilljs.com>
doctrine · Nov 19, 2021 · 9e6d5c5 · 9e6d5c5
1 parent 821b4f0
commit 9e6d5c5
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/src/Platforms/AbstractPlatform.php b/src/Platforms/AbstractPlatform.php
@@ -3384,11 +3384,11 @@ final public function modifyLimitQuery($query, $limit, $offset = 0)
     protected function doModifyLimitQuery($query, $limit, $offset)
     {
         if ($limit !== null) {
-            $query .= ' LIMIT ' . $limit;
+            $query .= sprintf(' LIMIT %d', $limit);
         }
 
         if ($offset > 0) {
-            $query .= ' OFFSET ' . $offset;
+            $query .= sprintf(' OFFSET %d', $offset);
         }
 
         return $query;

diff --git a/src/Platforms/MySQLPlatform.php b/src/Platforms/MySQLPlatform.php
@@ -50,14 +50,14 @@ class MySQLPlatform extends AbstractPlatform
     protected function doModifyLimitQuery($query, $limit, $offset)
     {
         if ($limit !== null) {
-            $query .= ' LIMIT ' . $limit;
+            $query .= sprintf(' LIMIT %d', $limit);
 
             if ($offset > 0) {
-                $query .= ' OFFSET ' . $offset;
+                $query .= sprintf(' OFFSET %d', $offset);
             }
         } elseif ($offset > 0) {
             // 2^64-1 is the maximum of unsigned BIGINT, the biggest limit possible
-            $query .= ' LIMIT 18446744073709551615 OFFSET ' . $offset;
+            $query .= sprintf(' LIMIT 18446744073709551615 OFFSET %d', $offset);
         }
 
         return $query;

diff --git a/src/Platforms/SqlitePlatform.php b/src/Platforms/SqlitePlatform.php
@@ -765,7 +765,7 @@ protected function getPostAlterTableIndexForeignKeySQL(TableDiff $diff)
     protected function doModifyLimitQuery($query, $limit, $offset)
     {
         if ($limit === null && $offset > 0) {
-            return $query . ' LIMIT -1 OFFSET ' . $offset;
+            return $query . sprintf(' LIMIT -1 OFFSET %d', $offset);
         }
 
         return parent::doModifyLimitQuery($query, $limit, $offset);