oci8po: prevent replacement of '?' within strings

When processing an SQL statement containing a '?' character within a
string, ADOdb wrongly assumed it is for a bind variable.  The number of
variables then no longer matches the number passed, and crashes the
_query() function.

We now identify whether a '?' is within a string and don't use it as a
bind variable if so.

Fixes #132

Signed-off-by: Damien Regad <dregad@mantisbt.org>

1 files changed, 11 insertions, 0 deletions

diff --git a/drivers/adodb-oci8po.inc.php b/drivers/adodb-oci8po.inc.php
index 95a7d322..1f82e456 100644
--- a/drivers/adodb-oci8po.inc.php
+++ b/drivers/adodb-oci8po.inc.php
@@ -64,11 +64,22 @@ class ADODB_oci8po extends ADODB_oci8 {
 					$arr['bind'.$i++] = $v;
 				}
 			} else {
+				// Need to identify if the ? is inside a quoted string, and if
+				// so not use it as a bind variable
+				preg_match_all('/".*\??"|\'.*\?.*?\'/', $sql, $matches);
+				foreach($matches[0] as $qmMatch){
+					$qmReplace = str_replace('?', '-QUESTIONMARK-', $qmMatch);
+					$sql = str_replace($qmMatch, $qmReplace, $sql);
+				}
+
 				$sqlarr = explode('?',$sql);
 				$sql = $sqlarr[0];
+
 				foreach($inputarr as $k => $v) {
 					$sql .=  ":$k" . $sqlarr[++$i];
 				}
+
+				$sql = str_replace('-QUESTIONMARK-', '?', $sql);
 			}
 		}
 		return ADODB_oci8::_query($sql,$inputarr);