[inc/Database] Support expanding nested arrays

In parametrized queries, you can now pass an array as an
argument. This will result in the arguments being expanded
to :a1,:a2,:a3 which is suitable for "IN (:slist)"
constructs.

1 files changed, 42 insertions, 0 deletions

diff --git a/inc/database.inc.php b/inc/database.inc.php
index ff98f5ee..f3a90fe7 100644
--- a/inc/database.inc.php
+++ b/inc/database.inc.php
@@ -100,6 +100,8 @@ class Database
 	public static function simpleQuery($query, $args = array(), $ignoreError = false)
 	{
 		self::init();
+		// Support passing nested arrays for IN statements, automagically refactor
+		self::handleArrayArgument($query, $args);
 		try {
 			if (!isset(self::$statements[$query])) {
 				self::$statements[$query] = self::$dbh->prepare($query);
@@ -123,6 +125,46 @@ class Database
 	}
 
 	/**
+	 * Convert nested array argument to multiple arguments.
+	 * If you have:
+	 * $query = 'SELECT * FROM tbl WHERE bcol = :bool AND col IN (:list)
+	 * $args = ( 'bool' => 1, 'list' => ('foo', 'bar') )
+	 * it results in:
+	 * $query = '...WHERE bcol = :bool AND col IN (:list_0, :list_1)
+	 * $args = ( 'bool' => 1, 'list_0' => 'foo', 'list_1' => 'bar' )
+	 *
+	 * @param string $query sql query string
+	 * @param array $args query arguments
+	 */
+	private static function handleArrayArgument(&$query, &$args)
+	{
+		foreach (array_keys($args) as $key) {
+			if (is_numeric($key) || $key === '?')
+				continue;
+			if (is_array($args[$key])) {
+				if (empty($args[$key])) {
+					// Empty list - what to do? We try to generate a query string that will not yield any result
+					$args[$key] = 'asdf' . mt_rand(0,PHP_INT_MAX) . mt_rand(0,PHP_INT_MAX)
+							. mt_rand(0,PHP_INT_MAX) . '@' . microtime(true);
+					continue;
+				}
+				$newkey = $key;
+				if ($newkey{0} !== ':') {
+					$newkey = ":$newkey";
+				}
+				$new = array();
+				foreach ($args[$key] as $subIndex => $sub) {
+					$new[] = $newkey . '_' . $subIndex;
+					$args[$newkey . '_' . $subIndex] = $sub;
+				}
+				unset($args[$key]);
+				$new = implode(',', $new);
+				$query = preg_replace('/' . $newkey . '\b/', $new, $query);
+			}
+		}
+	}
+
+	/**
 	 * Simply calls PDO::prepare and returns the PDOStatement.
 	 * You must call PDOStatement::execute manually on it.
 	 */