修正数据库参数绑定一处BUG

Author: liu21st

ThinkPHP/Library/Think/Db/Driver.class.php

@@ -414,11 +414,11 @@ protected function parseSet($data)
             } elseif (is_scalar($val)) {
                 // 过滤非标量数据
                 if (0 === strpos($val, ':') && in_array($val, array_keys($this->bind))) {
-                    $set[] = $this->parseKey($key) . '=' . $this->escapeString($val);
+                    $set[] = $this->parseKey($key) . '=' . $val;
                 } else {
                     $name  = count($this->bind);
-                    $set[] = $this->parseKey($key) . '=:' . $name;
-                    $this->bindParam($name, $val);
+                    $set[] = $this->parseKey($key) . '=:' . $key . '_' . $name;
+                    $this->bindParam($key . '_' . $name, $val);
                 }
             }
         }
@@ -443,7 +443,7 @@ protected function bindParam($name, $value)
      * @param string $key
      * @return string
      */
-    protected function parseKey(&$key)
+    protected function parseKey($key)
     {
         return $key;
     }
@@ -522,8 +522,7 @@ protected function parseTable($tables)
             }
             $tables = $array;
         } elseif (is_string($tables)) {
-            $tables = explode(',', $tables);
-            array_walk($tables, array(&$this, 'parseKey'));
+            $tables = array_map(array($this, 'parseKey'), explode(',', $tables));
         }
         return implode(',', $tables);
     }
@@ -909,11 +908,11 @@ public function insert($data, $options = array(), $replace = false)
                 // 过滤非标量数据
                 $fields[] = $this->parseKey($key);
                 if (0 === strpos($val, ':') && in_array($val, array_keys($this->bind))) {
-                    $values[] = $this->parseValue($val);
+                    $values[] = $val;
                 } else {
                     $name     = count($this->bind);
-                    $values[] = ':' . $name;
-                    $this->bindParam($name, $val);
+                    $values[] = ':' . $key . '_' . $name;
+                    $this->bindParam($key . '_' . $name, $val);
                 }
             }
         }
@@ -982,8 +981,8 @@ public function selectInsert($fields, $table, $options = array())
             $fields = explode(',', $fields);
         }
 
-        array_walk($fields, array($this, 'parseKey'));
-        $sql = 'INSERT INTO ' . $this->parseTable($table) . ' (' . implode(',', $fields) . ') ';
+        $fields = array_map(array($this, 'parseKey'), $fields);
+        $sql    = 'INSERT INTO ' . $this->parseTable($table) . ' (' . implode(',', $fields) . ') ';
         $sql .= $this->buildSelectSql($options);
         return $this->execute($sql, !empty($options['fetch_sql']) ? true : false);
     }

ThinkPHP/Library/Think/Db/Driver/Mysql.class.php

@@ -98,7 +98,7 @@ public function getTables($dbName = '')
      * @param string $key
      * @return string
      */
-    protected function parseKey(&$key)
+    protected function parseKey($key)
     {
         $key = trim($key);
         if (!is_numeric($key) && !preg_match('/[,\'\"\*\(\)`.\s]/', $key)) {
@@ -197,10 +197,10 @@ protected function parseDuplicate($duplicate)
                 }
 
                 switch ($val[0]) {
-                    case 'exp': // 表达式
+                    case 'exp':    // 表达式
                         $updates[] = $this->parseKey($key) . "=($val[1])";
                         break;
-                    case 'value': // 值
+                    case 'value':// 值
                     default:
                         $name      = count($this->bind);
                         $updates[] = $this->parseKey($key) . "=:" . $name;

ThinkPHP/Library/Think/Db/Driver/Sqlsrv.class.php

@@ -109,7 +109,7 @@ protected function parseOrder($order)
      * @param string $key
      * @return string
      */
-    protected function parseKey(&$key)
+    protected function parseKey($key)
     {
         $key = trim($key);
         if (!is_numeric($key) && !preg_match('/[,\'\"\*\(\)\[.\s]/', $key)) {