Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

PartialSearchFilter: ESCAPE '\' breaks multi-value queries on PostgreSQL with PHP < 8.4 (HY093)

Open
  • Is something wrong?
#8,642 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
php, postgresql
Domain
backend-api-design, databases

Research direction

Start by locating PartialSearchFilter and its formatLikeValue() method, then inspect the filter tests for multi-value queries and LIKE ... ESCAPE behavior. Reproduce the reported case with PostgreSQL on PHP 8.3 and check the existing behavior on PHP 8.4. Done means multi-value partial searches work on affected PostgreSQL versions without breaking escaping of % and _ or other supported databases.

Written by the indexing model from the issue text.

Description

API Platform version(s) affected: 4.4.3

(Doctrine ORM 3.5.0, Doctrine DBAL 3.9.5, PHP 8.3.33 with pdo_pgsql, PostgreSQL 17. The ESCAPE '\' clause is identical on the 4.4, 5.0 and main branches.)

Description

With PostgreSQL on PHP < 8.4, PartialSearchFilter breaks as soon as a bound parameter follows its LIKE ... ESCAPE '\' clause. The most visible case is a multi-value query (?name[]=foo&name[]=bar): the collection request fails with

SQLSTATE[HY093]: Invalid parameter number: parameter was not defined

(first thrown by the pagination count query, Doctrine\ORM\Tools\Pagination\Paginator::count()). A single value works, because its only placeholder comes before the escape literal.

This is related to #8434 (Oracle), but the cause is different. Here the generated SQL is correct, and DBAL's own SQL parser also sees both placeholders:

WHERE f0_.name LIKE ? ESCAPE '\' OR f0_.name LIKE ? ESCAPE '\'

(Connection::quote('\') returns '\' on pdo_pgsql; standard_conforming_strings is on.)

The failure comes from PDO itself. Before PHP 8.4, PDO's generic placeholder scanner treats a backslash inside a quoted string as an escape character, so '\' is read as an unterminated string and every ? after it is ignored. PHP 8.4 introduced driver-specific SQL parsers, and the same query works there.

How to reproduce

Plain PDO, no API Platform or Doctrine involved:

$pdo = new PDO('pgsql:host=...;dbname=...', $user, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);

// OK: single placeholder, before the escape literal
$pdo->prepare("SELECT 'abc' LIKE ? ESCAPE '\\'")->execute(['%b%']);

// PHP 8.3.33: SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
// PHP 8.4.26: OK
$pdo->prepare("SELECT 'abc' LIKE ? ESCAPE '\\' OR 'abc' LIKE ? ESCAPE '\\'")->execute(['%b%', '%z%']);

// OK on PHP 8.3: no escape clause, or another escape character
$pdo->prepare("SELECT 'abc' LIKE ? OR 'abc' LIKE ?")->execute(['%b%', '%z%']);
$pdo->prepare("SELECT 'abc' LIKE ? ESCAPE '!' OR 'abc' LIKE ? ESCAPE '!'")->execute(['%b%', '%z%']);

With API Platform:

#[ApiResource(operations: [
    new GetCollection(parameters: [
        'name' => new QueryParameter(filter: new PartialSearchFilter()),
    ]),
])]
#[ORM\Entity]
class Book { /* ... string $name ... */ }

GET /books?name=foo                   → 200
GET /books?name[]=foo&name[]=bar      → 500 (HY093)

The legacy SearchFilter with the partial strategy works with the same request, since it emits no ESCAPE clause. So migrating from #[ApiFilter(SearchFilter::class)] to PartialSearchFilter, as the 4.4 deprecation suggests, introduces this regression on PostgreSQL with PHP < 8.4.

Possible Solution

Use an escape character that needs no backslash, for example ESCAPE '!', and escape !, % and _ with it in formatLikeValue(). That avoids this PDO issue, and per #8434 it also suits Oracle. I only verified ESCAPE '!' on PostgreSQL (snippet above).

Additional Context

Verified with the same PostgreSQL 17 server and the same PDO snippet on PHP 8.3.33 (fails) and PHP 8.4.26 (passes). As a workaround, we use a custom FilterInterface implementation that emits LIKE without an ESCAPE clause.

Dominant language
PHP
Stars
2.6k
Forks
987
Avg merge
1d 7h
Merged PRs (30d)
84

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from api-platform/core

All issues in api-platform/core

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.