quote the criteria string in ActiveRecord.

1 files changed, 13 insertions, 4 deletions

diff --git a/framework/Data/ActiveRecord/Vendor/TPgsqlMetaData.php b/framework/Data/ActiveRecord/Vendor/TPgsqlMetaData.php
index 5fc0fcaf..35452849 100644
--- a/framework/Data/ActiveRecord/Vendor/TPgsqlMetaData.php
+++ b/framework/Data/ActiveRecord/Vendor/TPgsqlMetaData.php
@@ -26,24 +26,33 @@ class TPgsqlMetaData extends TDbMetaDataCommon
 {

 	/**

 	 * Build the SQL search string from the criteria object for Postgress database.

+	 * @param TDbConnection database connection.

 	 * @param TActiveRecordCriteria search criteria.

 	 * @return string SQL search.

 	 */

-	protected function getSqlFromCriteria(TActiveRecordCriteria $criteria)

+	protected function getSqlFromCriteria($conn, TActiveRecordCriteria $criteria)

 	{

 		$sql = '';

 		if(($condition = $criteria->getCondition())!==null)

 			$sql .= $condition;

 		$orders=array();

 		foreach($criteria->getOrdersBy() as $by=>$ordering)

-			$orders[] = $by.' '.$ordering;

+			$orders[] = $conn->quoteString($by).' '.$this->getOrdering($ordering);

 		if(count($orders) > 0)

 			$sql .= ' ORDER BY '.implode(', ', $orders);

 		if(($limit = $criteria->getLimit())!==null)

-			$sql .= ' LIMIT '.$limit;

+			$sql .= ' LIMIT '.intval($limit); //assumes integer limit?

 		if(($offset = $criteria->getOffset())!==null)

-			$sql .= ' OFFSET '.$offset;

+			$sql .= ' OFFSET '.intval($offset); //assumes integer offset?

 		return strlen($sql) > 0 ? ' WHERE '.$sql : '';

 	}

+

+	private function getOrdering($direction)

+	{

+		if(strtolower($direction) == 'desc')

+			return 'DESC';

+		else

+			return 'ASC';

+	}

 }
 ?>
\ No newline at end of file