Prevent SQL injection by identifiers

composer.json

@@ -7,7 +7,8 @@
             "Phenix\\": "src/"
         },
         "files": [
-            "src/functions.php"
+            "src/functions.php",
+            "src/Database/functions.php"
         ]
     },
     "autoload-dev": {

src/Database/Alias.php

@@ -4,10 +4,13 @@
 
 namespace Phenix\Database;
 
+use Phenix\Database\Concerns\HasDriver;
 use Stringable;
 
 class Alias implements Stringable
 {
+    use HasDriver;
+
     protected string $alias;
 
     public function __construct(protected readonly string $name)
@@ -24,7 +27,14 @@ public function as(string $alias): self
 
     public function __toString(): string
     {
-        return "{$this->name} AS {$this->alias}";
+        $parts = array_map(
+            fn (string $part): string => (string) Wrapper::of($this->getDriver(), $part),
+            explode('.', $this->name)
+        );
+
+        $alias = Wrapper::of($this->getDriver(), $this->alias);
+
+        return implode('.', $parts) . " AS {$alias}";
     }
 
     public static function of(string $name): self

src/Database/Clause.php

@@ -4,93 +4,9 @@
 
 namespace Phenix\Database;
 
-use Closure;
-use Phenix\Database\Clauses\BasicWhereClause;
-use Phenix\Database\Clauses\SubqueryWhereClause;
-use Phenix\Database\Clauses\WhereClause;
-use Phenix\Database\Concerns\Query\HasWhereClause;
-use Phenix\Database\Concerns\Query\PrepareColumns;
-use Phenix\Database\Constants\LogicalConnector;
-use Phenix\Database\Constants\Operator;
 use Phenix\Database\Contracts\Builder;
 
-use function count;
-
-abstract class Clause extends Grammar implements Builder
+abstract class Clause extends ClauseBuilder implements Builder
 {
-    use HasWhereClause;
-    use PrepareColumns;
-
-    /**
-     * @var array<int, WhereClause>
-     */
-    protected array $clauses;
-
-    protected array $arguments;
-
-    protected function resolveWhereMethod(
-        string $column,
-        Operator $operator,
-        Closure|array|string|int $value,
-        LogicalConnector $logicalConnector = LogicalConnector::AND
-    ): void {
-        if ($value instanceof Closure) {
-            $this->whereSubquery(
-                subquery: $value,
-                comparisonOperator: $operator,
-                column: $column,
-                logicalConnector: $logicalConnector
-            );
-        } else {
-            $this->pushWhereWithArgs($column, $operator, $value, $logicalConnector);
-        }
-    }
-
-    protected function whereSubquery(
-        Closure $subquery,
-        Operator $comparisonOperator,
-        string|null $column = null,
-        Operator|null $operator = null,
-        LogicalConnector $logicalConnector = LogicalConnector::AND
-    ): void {
-        $builder = new Subquery($this->driver);
-        $builder->select(['*']);
-
-        $subquery($builder);
-
-        [$dml, $arguments] = $builder->toSql();
-
-        $connector = count($this->clauses) === 0 ? null : $logicalConnector;
-
-        $this->clauses[] = new SubqueryWhereClause(
-            comparisonOperator: $comparisonOperator,
-            sql: trim($dml, '()'),
-            params: $arguments,
-            column: $column,
-            operator: $operator,
-            connector: $connector
-        );
-
-        $this->arguments = array_merge($this->arguments, $arguments);
-    }
-
-    protected function pushWhereWithArgs(
-        string $column,
-        Operator $operator,
-        array|string|int $value,
-        LogicalConnector $logicalConnector = LogicalConnector::AND
-    ): void {
-        $this->pushClause(new BasicWhereClause($column, $operator, $value, null, true), $logicalConnector);
-
-        $this->arguments = array_merge($this->arguments, (array) $value);
-    }
-
-    protected function pushClause(WhereClause $where, LogicalConnector $logicalConnector = LogicalConnector::AND): void
-    {
-        if (count($this->clauses) > 0) {
-            $where->setConnector($logicalConnector);
-        }
-
-        $this->clauses[] = $where;
-    }
+    //
 }

src/Database/ClauseBuilder.php

@@ -0,0 +1,161 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Phenix\Database;
+
+use Closure;
+use Phenix\Database\Clauses\BasicWhereClause;
+use Phenix\Database\Clauses\RowWhereClause;
+use Phenix\Database\Clauses\SubqueryWhereClause;
+use Phenix\Database\Clauses\WhereClause;
+use Phenix\Database\Concerns\Query\HasWhereClause;
+use Phenix\Database\Constants\LogicalConnector;
+use Phenix\Database\Constants\Operator;
+
+use function count;
+
+abstract class ClauseBuilder extends Grammar
+{
+    use HasWhereClause;
+
+    /**
+     * @var array<int, WhereClause>
+     */
+    protected array $clauses;
+
+    /**
+     * @var array<int, mixed>
+     */
+    protected array $arguments;
+
+    /**
+     * @return array<int, WhereClause>
+     */
+    protected function getClauses(): array
+    {
+        return $this->clauses;
+    }
+
+    /**
+     * @return array<int, mixed>
+     */
+    protected function getArguments(): array
+    {
+        return $this->arguments;
+    }
+
+    protected function hasWhereClauses(): bool
+    {
+        return count($this->getClauses()) > 0;
+    }
+
+    protected function addArguments(array $arguments): void
+    {
+        $this->arguments = [...$this->arguments, ...$arguments];
+    }
+
+    protected function pushWhereClause(
+        WhereClause $where,
+        LogicalConnector $logicalConnector = LogicalConnector::AND
+    ): void {
+        if ($this->hasWhereClauses()) {
+            $where->setConnector($logicalConnector);
+        }
+
+        $this->clauses[] = $where;
+    }
+
+    protected function resolveWhereMethod(
+        string $column,
+        Operator $operator,
+        Closure|array|string|int $value,
+        LogicalConnector $logicalConnector = LogicalConnector::AND
+    ): void {
+        if ($value instanceof Closure) {
+            $this->whereSubquery(
+                subquery: $value,
+                comparisonOperator: $operator,
+                column: $column,
+                logicalConnector: $logicalConnector
+            );
+        } else {
+            $this->pushWhereWithArgs($column, $operator, $value, $logicalConnector);
+        }
+    }
+
+    protected function whereSubquery(
+        Closure $subquery,
+        Operator $comparisonOperator,
+        string|null $column = null,
+        Operator|null $operator = null,
+        LogicalConnector $logicalConnector = LogicalConnector::AND
+    ): void {
+        $builder = new Subquery($this->driver);
+        $builder->setDriver($this->driver);
+        $builder->selectAllColumns();
+
+        $subquery($builder);
+
+        [$dml, $arguments] = $builder->toSql();
+
+        $connector = $this->hasWhereClauses() ? $logicalConnector : null;
+
+        $this->pushWhereClause(new SubqueryWhereClause(
+            comparisonOperator: $comparisonOperator,
+            sql: trim($dml, '()'),
+            params: $arguments,
+            column: $column,
+            operator: $operator,
+            connector: $connector
+        ), $logicalConnector);
+
+        $this->addArguments($arguments);
+    }
+
+    /**
+     * @param array<int, string> $columns
+     */
+    protected function whereRowSubquery(
+        Closure $subquery,
+        Operator $comparisonOperator,
+        array $columns,
+        LogicalConnector $logicalConnector = LogicalConnector::AND
+    ): void {
+        $builder = new Subquery($this->driver);
+        $builder->setDriver($this->driver);
+        $builder->selectAllColumns();
+
+        $subquery($builder);
+
+        [$dml, $arguments] = $builder->toSql();
+
+        $connector = $this->hasWhereClauses() ? $logicalConnector : null;
+
+        $this->pushWhereClause(new RowWhereClause(
+            columns: $columns,
+            comparisonOperator: $comparisonOperator,
+            sql: trim($dml, '()'),
+            params: $arguments,
+            connector: $connector
+        ), $logicalConnector);
+
+        $this->addArguments($arguments);
+    }
+
+    protected function pushWhereWithArgs(
+        string $column,
+        Operator $operator,
+        array|string|int $value,
+        LogicalConnector $logicalConnector = LogicalConnector::AND
+    ): void {
+        $this->pushClause(new BasicWhereClause($column, $operator, $value, null, true), $logicalConnector);
+
+        $this->addArguments((array) $value);
+    }
+
+    protected function pushClause(WhereClause $where, LogicalConnector $logicalConnector = LogicalConnector::AND): void
+    {
+        $this->pushWhereClause($where, $logicalConnector);
+    }
+}

src/Database/Clauses/BasicWhereClause.php

@@ -78,4 +78,9 @@ public function isInOperator(): bool
     {
         return $this->operator === Operator::IN || $this->operator === Operator::NOT_IN;
     }
+
+    public function usesPlaceholder(): bool
+    {
+        return $this->usePlaceholder;
+    }
 }

src/Database/Clauses/DateWhereClause.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Phenix\Database\Clauses;
+
+use Phenix\Database\Constants\DatabaseFunction;
+use Phenix\Database\Constants\LogicalConnector;
+use Phenix\Database\Constants\Operator;
+use Phenix\Database\Constants\SQL;
+
+class DateWhereClause extends WhereClause
+{
+    protected string $column;
+
+    protected Operator $operator;
+
+    protected DatabaseFunction $function;
+
+    protected string|int $value;
+
+    public function __construct(
+        string $column,
+        Operator $operator,
+        DatabaseFunction $function,
+        string|int $value,
+        LogicalConnector|null $connector = null
+    ) {
+        $this->column = $column;
+        $this->operator = $operator;
+        $this->function = $function;
+        $this->value = $value;
+        $this->connector = $connector;
+    }
+
+    public function getColumn(): string
+    {
+        return $this->column;
+    }
+
+    public function getOperator(): Operator
+    {
+        return $this->operator;
+    }
+
+    public function getFunction(): DatabaseFunction
+    {
+        return $this->function;
+    }
+
+    public function getValue(): string|int
+    {
+        return $this->value;
+    }
+
+    public function renderValue(): string
+    {
+        return SQL::PLACEHOLDER->value;
+    }
+}