Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

PartialSearchFilter: ESCAPE '\' breaks multi-value queries on PostgreSQL with PHP < 8.4 (HY093)

Abierto
  • ¿Algo no está bien?
#8,642 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
75/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php, postgresql
Área
backend-api-design, databases

Línea de trabajo

Start by locating PartialSearchFilter and its formatLikeValue() method, then inspect the filter tests for multi-value queries and LIKE ... ESCAPE behavior. Reproduce the reported case with PostgreSQL on PHP 8.3 and check the existing behavior on PHP 8.4. Done means multi-value partial searches work on affected PostgreSQL versions without breaking escaping of % and _ or other supported databases.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

API Platform version(s) affected: 4.4.3

(Doctrine ORM 3.5.0, Doctrine DBAL 3.9.5, PHP 8.3.33 with pdo_pgsql, PostgreSQL 17. The ESCAPE '\' clause is identical on the 4.4, 5.0 and main branches.)

Description

With PostgreSQL on PHP < 8.4, PartialSearchFilter breaks as soon as a bound parameter follows its LIKE ... ESCAPE '\' clause. The most visible case is a multi-value query (?name[]=foo&name[]=bar): the collection request fails with

SQLSTATE[HY093]: Invalid parameter number: parameter was not defined

(first thrown by the pagination count query, Doctrine\ORM\Tools\Pagination\Paginator::count()). A single value works, because its only placeholder comes before the escape literal.

This is related to #8434 (Oracle), but the cause is different. Here the generated SQL is correct, and DBAL's own SQL parser also sees both placeholders:

WHERE f0_.name LIKE ? ESCAPE '\' OR f0_.name LIKE ? ESCAPE '\'

(Connection::quote('\') returns '\' on pdo_pgsql; standard_conforming_strings is on.)

The failure comes from PDO itself. Before PHP 8.4, PDO's generic placeholder scanner treats a backslash inside a quoted string as an escape character, so '\' is read as an unterminated string and every ? after it is ignored. PHP 8.4 introduced driver-specific SQL parsers, and the same query works there.

How to reproduce

Plain PDO, no API Platform or Doctrine involved:

$pdo = new PDO('pgsql:host=...;dbname=...', $user, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);

// OK: single placeholder, before the escape literal
$pdo->prepare("SELECT 'abc' LIKE ? ESCAPE '\\'")->execute(['%b%']);

// PHP 8.3.33: SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
// PHP 8.4.26: OK
$pdo->prepare("SELECT 'abc' LIKE ? ESCAPE '\\' OR 'abc' LIKE ? ESCAPE '\\'")->execute(['%b%', '%z%']);

// OK on PHP 8.3: no escape clause, or another escape character
$pdo->prepare("SELECT 'abc' LIKE ? OR 'abc' LIKE ?")->execute(['%b%', '%z%']);
$pdo->prepare("SELECT 'abc' LIKE ? ESCAPE '!' OR 'abc' LIKE ? ESCAPE '!'")->execute(['%b%', '%z%']);

With API Platform:

#[ApiResource(operations: [
    new GetCollection(parameters: [
        'name' => new QueryParameter(filter: new PartialSearchFilter()),
    ]),
])]
#[ORM\Entity]
class Book { /* ... string $name ... */ }

GET /books?name=foo                   → 200
GET /books?name[]=foo&name[]=bar      → 500 (HY093)

The legacy SearchFilter with the partial strategy works with the same request, since it emits no ESCAPE clause. So migrating from #[ApiFilter(SearchFilter::class)] to PartialSearchFilter, as the 4.4 deprecation suggests, introduces this regression on PostgreSQL with PHP < 8.4.

Possible Solution

Use an escape character that needs no backslash, for example ESCAPE '!', and escape !, % and _ with it in formatLikeValue(). That avoids this PDO issue, and per #8434 it also suits Oracle. I only verified ESCAPE '!' on PostgreSQL (snippet above).

Additional Context

Verified with the same PostgreSQL 17 server and the same PDO snippet on PHP 8.3.33 (fails) and PHP 8.4.26 (passes). As a workaround, we use a custom FilterInterface implementation that emits LIKE without an ESCAPE clause.

Lenguaje dominante
PHP
Estrellas
2.6k
Forks
987
Merge medio
1 d 7 h
PR fusionados (30 d)
84

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de api-platform/core

Todos los issues de api-platform/core

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.