diff --git a/core/lib/Drupal/Core/Database/Driver/sqlite/Connection.php b/core/lib/Drupal/Core/Database/Driver/sqlite/Connection.php index 1891c11..5ef247c 100644 --- a/core/lib/Drupal/Core/Database/Driver/sqlite/Connection.php +++ b/core/lib/Drupal/Core/Database/Driver/sqlite/Connection.php @@ -145,15 +145,62 @@ public static function open(array &$connection_options = array()) { /** * {@inheritdoc} * - * For SQLite it is known that PARAM_LOB doesn't work with sqlite - * so we filter them out of bindValue when doing a query. Unlike the comment - * in the URL below PARAM_FLOAT doesn't exist. - * http://stackoverflow.com/questions/18750043/bind-resource-to-a-pdo-lob-param-on-sqlite + * For SQLite it is no method + * \Drupal\Core\Database\Driver\sqlite\Statement::bindValue() + * so we cannot call the method when doing a query. */ public function query($query, array $args = array(), $options = array(), $bindValue = array()) { - return parent::query($query, $args, $options, array_filter($bindValue, function ($pdoParam) { - return $pdoParam != \PDO::PARAM_LOB; - })); + // Use default values if not already set. + $options += $this->defaultOptions(); + + try { + // We allow either a pre-bound statement object or a literal string. + // In either case, we want to end up with an executed statement object, + // which we pass to PDOStatement::execute. + if ($query instanceof StatementInterface) { + $stmt = $query; + $stmt->execute(NULL, $options); + } + else { + $this->expandArguments($query, $args); + // To protect against SQL injection, Drupal only supports executing one + // statement at a time. Thus, the presence of a SQL delimiter (the + // semicolon) is not allowed unless the option is set. Allowing + // semicolons should only be needed for special cases like defining a + // function or stored procedure in SQL. Trim any trailing delimiter to + // minimize false positives. + $query = rtrim($query, "; \t\n\r\0\x0B"); + if (strpos($query, ';') !== FALSE && empty($options['allow_delimiter_in_query'])) { + throw new \InvalidArgumentException('; is not supported in SQL strings. Use only one statement at a time.'); + } + $stmt = $this->prepareQuery($query); + $stmt->execute($args, $options); + } + + // Depending on the type of query we may need to return a different value. + // See DatabaseConnection::defaultOptions() for a description of each + // value. + switch ($options['return']) { + case Database::RETURN_STATEMENT: + return $stmt; + case Database::RETURN_AFFECTED: + $stmt->allowRowCount = TRUE; + return $stmt->rowCount(); + case Database::RETURN_INSERT_ID: + $sequence_name = isset($options['sequence_name']) ? $options['sequence_name'] : NULL; + return $this->connection->lastInsertId($sequence_name); + case Database::RETURN_NULL: + return NULL; + default: + throw new \PDOException('Invalid return directive: ' . $options['return']); + } + } + catch (\PDOException $e) { + // Most database drivers will return NULL here, but some of them + // (e.g. the SQLite driver) may need to re-run the query, so the return + // value will be the same as for static::query(). + return $this->handleQueryException($e, $query, $args, $options); + } } /**