class QueryTest

Same name in this branch
  1. 10 core/modules/views/tests/src/Kernel/Plugin/QueryTest.php \Drupal\Tests\views\Kernel\Plugin\QueryTest
  2. 10 core/modules/views/tests/modules/views_test_data/src/Plugin/views/query/QueryTest.php \Drupal\views_test_data\Plugin\views\query\QueryTest
  3. 10 core/modules/views_ui/tests/src/Functional/QueryTest.php \Drupal\Tests\views_ui\Functional\QueryTest
  4. 10 core/tests/Drupal/Tests/Core/Entity/Query/Sql/QueryTest.php \Drupal\Tests\Core\Entity\Query\Sql\QueryTest
Same name in other branches
  1. 9 core/modules/views/tests/src/Kernel/Plugin/QueryTest.php \Drupal\Tests\views\Kernel\Plugin\QueryTest
  2. 9 core/modules/views/tests/modules/views_test_data/src/Plugin/views/query/QueryTest.php \Drupal\views_test_data\Plugin\views\query\QueryTest
  3. 9 core/modules/views_ui/tests/src/Functional/QueryTest.php \Drupal\Tests\views_ui\Functional\QueryTest
  4. 9 core/tests/Drupal/KernelTests/Core/Database/QueryTest.php \Drupal\KernelTests\Core\Database\QueryTest
  5. 9 core/tests/Drupal/Tests/Core/Entity/Query/Sql/QueryTest.php \Drupal\Tests\Core\Entity\Query\Sql\QueryTest
  6. 8.9.x core/modules/views/tests/src/Kernel/Plugin/QueryTest.php \Drupal\Tests\views\Kernel\Plugin\QueryTest
  7. 8.9.x core/modules/views/tests/modules/views_test_data/src/Plugin/views/query/QueryTest.php \Drupal\views_test_data\Plugin\views\query\QueryTest
  8. 8.9.x core/modules/views_ui/tests/src/Functional/QueryTest.php \Drupal\Tests\views_ui\Functional\QueryTest
  9. 8.9.x core/tests/Drupal/KernelTests/Core/Database/QueryTest.php \Drupal\KernelTests\Core\Database\QueryTest
  10. 8.9.x core/tests/Drupal/Tests/Core/Entity/Query/Sql/QueryTest.php \Drupal\Tests\Core\Entity\Query\Sql\QueryTest
  11. 11.x core/modules/views/tests/src/Kernel/Plugin/QueryTest.php \Drupal\Tests\views\Kernel\Plugin\QueryTest
  12. 11.x core/modules/views/tests/modules/views_test_data/src/Plugin/views/query/QueryTest.php \Drupal\views_test_data\Plugin\views\query\QueryTest
  13. 11.x core/modules/views_ui/tests/src/Functional/QueryTest.php \Drupal\Tests\views_ui\Functional\QueryTest
  14. 11.x core/tests/Drupal/KernelTests/Core/Database/QueryTest.php \Drupal\KernelTests\Core\Database\QueryTest
  15. 11.x core/tests/Drupal/Tests/Core/Entity/Query/Sql/QueryTest.php \Drupal\Tests\Core\Entity\Query\Sql\QueryTest

Tests Drupal's extended prepared statement syntax..

@coversDefaultClass \Drupal\Core\Database\Connection @group Database

Hierarchy

Expanded class hierarchy of QueryTest

1 string reference to 'QueryTest'
QueryTest::calculateDependencies in core/modules/views/tests/modules/views_test_data/src/Plugin/views/query/QueryTest.php
Calculates dependencies for the configured plugin.

File

core/tests/Drupal/KernelTests/Core/Database/QueryTest.php, line 17

Namespace

Drupal\KernelTests\Core\Database
View source
class QueryTest extends DatabaseTestBase {
    
    /**
     * Tests that we can pass an array of values directly in the query.
     */
    public function testArraySubstitution() : void {
        $names = $this->connection
            ->query('SELECT [name] FROM {test} WHERE [age] IN ( :ages[] ) ORDER BY [age]', [
            ':ages[]' => [
                25,
                26,
                27,
            ],
        ])
            ->fetchAll();
        $this->assertCount(3, $names, 'Correct number of names returned');
        $names = $this->connection
            ->query('SELECT [name] FROM {test} WHERE [age] IN ( :ages[] ) ORDER BY [age]', [
            ':ages[]' => [
                25,
            ],
        ])
            ->fetchAll();
        $this->assertCount(1, $names, 'Correct number of names returned');
    }
    
    /**
     * Tests that we can not pass a scalar value when an array is expected.
     */
    public function testScalarSubstitution() : void {
        try {
            $names = $this->connection
                ->query('SELECT [name] FROM {test} WHERE [age] IN ( :ages[] ) ORDER BY [age]', [
                ':ages[]' => 25,
            ])
                ->fetchAll();
            $this->fail('Array placeholder with scalar argument should result in an exception.');
        } catch (\Exception $e) {
            $this->assertInstanceOf(\InvalidArgumentException::class, $e);
        }
    }
    
    /**
     * Tests SQL injection via database query array arguments.
     */
    public function testArrayArgumentsSQLInjection() : void {
        // Attempt SQL injection and verify that it does not work.
        $condition = [
            "1 ;INSERT INTO {test} (name) VALUES ('test12345678'); -- " => '',
            '1' => '',
        ];
        try {
            $this->connection
                ->query("SELECT * FROM {test} WHERE [name] = :name", [
                ':name' => $condition,
            ])
                ->fetchObject();
            $this->fail('SQL injection attempt via array arguments should result in a database exception.');
        } catch (\InvalidArgumentException $e) {
            // Expected exception; just continue testing.
        }
        // Test that the insert query that was used in the SQL injection attempt did
        // not result in a row being inserted in the database.
        $result = $this->connection
            ->select('test')
            ->condition('name', 'test12345678')
            ->countQuery()
            ->execute()
            ->fetchField();
        $this->assertEquals(0, $result, 'SQL injection attempt did not result in a row being inserted in the database table.');
    }
    
    /**
     * Tests SQL injection via condition operator.
     */
    public function testConditionOperatorArgumentsSQLInjection() : void {
        $injection = "IS NOT NULL) ;INSERT INTO {test} (name) VALUES ('test12345678'); -- ";
        $previous_error_handler = set_error_handler(function ($severity, $message, $filename, $lineno) use (&$previous_error_handler) {
            // Normalize the filename to use UNIX directory separators.
            if (preg_match('@core/lib/Drupal/Core/Database/Query/Condition.php$@', str_replace(DIRECTORY_SEPARATOR, '/', $filename))) {
                // Convert errors to exceptions for testing purposes below.
                throw new \ErrorException($message, 0, $severity, $filename, $lineno);
            }
            if ($previous_error_handler) {
                return $previous_error_handler($severity, $message, $filename, $lineno);
            }
        });
        try {
            $result = $this->connection
                ->select('test', 't')
                ->fields('t')
                ->condition('name', 1, $injection)
                ->execute();
            $this->fail('Should not be able to attempt SQL injection via condition operator.');
        } catch (\ErrorException $e) {
            // Expected exception; just continue testing.
        }
        // Test that the insert query that was used in the SQL injection attempt did
        // not result in a row being inserted in the database.
        $result = $this->connection
            ->select('test')
            ->condition('name', 'test12345678')
            ->countQuery()
            ->execute()
            ->fetchField();
        $this->assertEquals(0, $result, 'SQL injection attempt did not result in a row being inserted in the database table.');
        // Attempt SQLi via union query with no unsafe characters.
        $this->enableModules([
            'user',
        ]);
        $this->installEntitySchema('user');
        $this->connection
            ->insert('test')
            ->fields([
            'name' => '123456',
        ])
            ->execute();
        $injection = "= 1 UNION ALL SELECT password FROM user WHERE uid =";
        try {
            $result = $this->connection
                ->select('test', 't')
                ->fields('t', [
                'name',
                'name',
            ])
                ->condition('name', 1, $injection)
                ->execute();
            $this->fail('Should not be able to attempt SQL injection via operator.');
        } catch (\ErrorException $e) {
            // Expected exception; just continue testing.
        }
        // Attempt SQLi via union query - uppercase tablename.
        $this->connection
            ->insert('TEST_UPPERCASE')
            ->fields([
            'name' => 'secrets',
        ])
            ->execute();
        $injection = "IS NOT NULL) UNION ALL SELECT name FROM {TEST_UPPERCASE} -- ";
        try {
            $result = $this->connection
                ->select('test', 't')
                ->fields('t', [
                'name',
            ])
                ->condition('name', 1, $injection)
                ->execute();
            $this->fail('Should not be able to attempt SQL injection via operator.');
        } catch (\ErrorException $e) {
            // Expected exception; just continue testing.
        }
        restore_error_handler();
    }
    
    /**
     * Tests numeric query parameter expansion in expressions.
     *
     * @see \Drupal\sqlite\Driver\Database\sqlite\Statement::getStatement()
     * @see http://bugs.php.net/bug.php?id=45259
     */
    public function testNumericExpressionSubstitution() : void {
        $count_expected = $this->connection
            ->query('SELECT COUNT(*) + 3 FROM {test}')
            ->fetchField();
        $count = $this->connection
            ->query('SELECT COUNT(*) + :count FROM {test}', [
            ':count' => 3,
        ])
            ->fetchField();
        $this->assertEquals($count_expected, $count);
    }
    
    /**
     * Tests quoting identifiers in queries.
     */
    public function testQuotingIdentifiers() : void {
        // Use the table named an ANSI SQL reserved word with a column that is as
        // well.
        $result = $this->connection
            ->query('SELECT [update] FROM {select}')
            ->fetchObject();
        $this->assertEquals('Update value 1', $result->update);
    }
    
    /**
     * Tests deprecation of the 'return' query option.
     *
     * @covers ::query
     * @covers ::prepareStatement
     *
     * @group legacy
     */
    public function testReturnOptionDeprecation() : void {
        $this->expectDeprecation('Passing "return" option to %Aquery() is deprecated in drupal:9.4.0 and is removed in drupal:11.0.0. For data manipulation operations, use dynamic queries instead. See https://www.drupal.org/node/3185520');
        $this->expectDeprecation('Passing "return" option to %AprepareStatement() is deprecated in drupal:9.4.0 and is removed in drupal:11.0.0. For data manipulation operations, use dynamic queries instead. See https://www.drupal.org/node/3185520');
        $this->assertIsInt((int) $this->connection
            ->query('INSERT INTO {test} ([name], [age], [job]) VALUES (:name, :age, :job)', [
            ':name' => 'Magoo',
            ':age' => 56,
            ':job' => 'Driver',
        ], [
            'return' => Database::RETURN_INSERT_ID,
        ]));
    }

}

Members

Title Sort descending Deprecated Modifiers Object type Summary Overriden Title Overrides
AssertContentTrait::$content protected property The current raw content.
AssertContentTrait::$drupalSettings protected property The drupalSettings value from the current raw $content.
AssertContentTrait::$elements protected property The XML structure parsed from the current raw $content. 1
AssertContentTrait::$plainTextContent protected property The plain-text content of raw $content (text nodes).
AssertContentTrait::assertEscaped protected function Passes if the raw text IS found escaped on the loaded page, fail otherwise.
AssertContentTrait::assertField protected function Asserts that a field exists with the given name or ID.
AssertContentTrait::assertFieldById protected function Asserts that a field exists with the given ID and value.
AssertContentTrait::assertFieldByName protected function Asserts that a field exists with the given name and value.
AssertContentTrait::assertFieldByXPath protected function Asserts that a field exists in the current page by the given XPath.
AssertContentTrait::assertFieldChecked protected function Asserts that a checkbox field in the current page is checked.
AssertContentTrait::assertFieldsByValue protected function Asserts that a field exists in the current page with a given Xpath result.
AssertContentTrait::assertLink protected function Passes if a link with the specified label is found.
AssertContentTrait::assertLinkByHref protected function Passes if a link containing a given href (part) is found.
AssertContentTrait::assertNoDuplicateIds protected function Asserts that each HTML ID is used for just a single element.
AssertContentTrait::assertNoEscaped protected function Passes if raw text IS NOT found escaped on loaded page, fail otherwise.
AssertContentTrait::assertNoField protected function Asserts that a field does not exist with the given name or ID.
AssertContentTrait::assertNoFieldById protected function Asserts that a field does not exist with the given ID and value.
AssertContentTrait::assertNoFieldByName protected function Asserts that a field does not exist with the given name and value.
AssertContentTrait::assertNoFieldByXPath protected function Asserts that a field does not exist or its value does not match, by XPath.
AssertContentTrait::assertNoFieldChecked protected function Asserts that a checkbox field in the current page is not checked.
AssertContentTrait::assertNoLink protected function Passes if a link with the specified label is not found.
AssertContentTrait::assertNoLinkByHref protected function Passes if a link containing a given href (part) is not found.
AssertContentTrait::assertNoLinkByHrefInMainRegion protected function Passes if a link containing a given href is not found in the main region.
AssertContentTrait::assertNoOption protected function Asserts that a select option in the current page does not exist.
AssertContentTrait::assertNoOptionSelected protected function Asserts that a select option in the current page is not checked.
AssertContentTrait::assertNoPattern protected function Triggers a pass if the perl regex pattern is not found in raw content.
AssertContentTrait::assertNoRaw protected function Passes if the raw text is NOT found on the loaded page, fail otherwise.
AssertContentTrait::assertNoText protected function Passes if the page (with HTML stripped) does not contains the text.
AssertContentTrait::assertNoTitle protected function Pass if the page title is not the given string.
AssertContentTrait::assertNoUniqueText protected function Passes if the text is found MORE THAN ONCE on the text version of the page.
AssertContentTrait::assertOption protected function Asserts that a select option in the current page exists.
AssertContentTrait::assertOptionByText protected function Asserts that a select option with the visible text exists.
AssertContentTrait::assertOptionSelected protected function Asserts that a select option in the current page is checked.
AssertContentTrait::assertOptionSelectedWithDrupalSelector protected function Asserts that a select option in the current page is checked.
AssertContentTrait::assertOptionWithDrupalSelector protected function Asserts that a select option in the current page exists.
AssertContentTrait::assertPattern protected function Triggers a pass if the Perl regex pattern is found in the raw content.
AssertContentTrait::assertRaw protected function Passes if the raw text IS found on the loaded page, fail otherwise.
AssertContentTrait::assertText protected function Passes if the page (with HTML stripped) contains the text.
AssertContentTrait::assertTextHelper protected function Helper for assertText and assertNoText.
AssertContentTrait::assertTextPattern protected function Asserts that a Perl regex pattern is found in the plain-text content.
AssertContentTrait::assertThemeOutput protected function Asserts themed output.
AssertContentTrait::assertTitle protected function Pass if the page title is the given string.
AssertContentTrait::assertUniqueText protected function Passes if the text is found ONLY ONCE on the text version of the page.
AssertContentTrait::assertUniqueTextHelper protected function Helper for assertUniqueText and assertNoUniqueText.
AssertContentTrait::buildXPathQuery protected function Builds an XPath query.
AssertContentTrait::constructFieldXpath protected function Helper: Constructs an XPath for the given set of attributes and value.
AssertContentTrait::cssSelect protected function Searches elements using a CSS selector in the raw content.
AssertContentTrait::getAllOptions protected function Get all option elements, including nested options, in a select.
AssertContentTrait::getDrupalSettings protected function Gets the value of drupalSettings for the currently-loaded page.
AssertContentTrait::getRawContent protected function Gets the current raw content.
AssertContentTrait::getSelectedItem protected function Get the selected value from a select field.
AssertContentTrait::getTextContent protected function Retrieves the plain-text content from the current raw content.
AssertContentTrait::parse protected function Parse content returned from curlExec using DOM and SimpleXML.
AssertContentTrait::removeWhiteSpace protected function Removes all white-space between HTML tags from the raw content.
AssertContentTrait::setDrupalSettings protected function Sets the value of drupalSettings for the currently-loaded page.
AssertContentTrait::setRawContent protected function Sets the raw content (e.g. HTML).
AssertContentTrait::xpath protected function Performs an xpath search on the contents of the internal browser.
ConfigTestTrait::configImporter protected function Returns a ConfigImporter object to import test configuration.
ConfigTestTrait::copyConfig protected function Copies configuration objects from source storage to target storage.
DatabaseTestBase::$connection protected property The database connection for testing.
DatabaseTestBase::$modules protected static property Modules to install. Overrides KernelTestBase::$modules 3
DatabaseTestBase::ensureSampleDataNull public function Sets up tables for NULL handling.
DatabaseTestBase::setUp protected function Overrides KernelTestBase::setUp 1
DatabaseTestSchemaDataTrait::addSampleData protected function Sets up our sample data.
DatabaseTestSchemaInstallTrait::installSampleSchema protected function Sets up our sample table schema.
ExtensionListTestTrait::getModulePath protected function Gets the path for the specified module.
ExtensionListTestTrait::getThemePath protected function Gets the path for the specified theme.
KernelTestBase::$backupGlobals protected property Back up and restore any global variables that may be changed by tests.
KernelTestBase::$backupStaticAttributes protected property Back up and restore static class properties that may be changed by tests.
KernelTestBase::$backupStaticAttributesBlacklist protected property Contains a few static class properties for performance.
KernelTestBase::$classLoader protected property
KernelTestBase::$configImporter protected property @todo Move into Config test base class. 6
KernelTestBase::$configSchemaCheckerExclusions protected static property An array of config object names that are excluded from schema checking. 3
KernelTestBase::$container protected property
KernelTestBase::$databasePrefix protected property
KernelTestBase::$keyValue protected property The key_value service that must persist between container rebuilds.
KernelTestBase::$preserveGlobalState protected property Do not forward any global state from the parent process to the processes
that run the actual tests.
KernelTestBase::$root protected property The app root.
KernelTestBase::$runTestInSeparateProcess protected property Kernel tests are run in separate processes because they allow autoloading
of code from extensions. Running the test in a separate process isolates
this behavior from other tests. Subclasses should not override this
property.
KernelTestBase::$siteDirectory protected property
KernelTestBase::$strictConfigSchema protected property Set to TRUE to strict check all configuration saved. 9
KernelTestBase::$usesSuperUserAccessPolicy protected property Set to TRUE to make user 1 a super user. 7
KernelTestBase::$vfsRoot protected property The virtual filesystem root directory.
KernelTestBase::assertPostConditions protected function 1
KernelTestBase::bootEnvironment protected function Bootstraps a basic test environment.
KernelTestBase::bootKernel protected function Bootstraps a kernel for a test. 1
KernelTestBase::config protected function Configuration accessor for tests. Returns non-overridden configuration.
KernelTestBase::disableModules protected function Disables modules for this test.
KernelTestBase::enableModules protected function Enables modules for this test. 1
KernelTestBase::getConfigSchemaExclusions protected function Gets the config schema exclusions for this test.
KernelTestBase::getDatabaseConnectionInfo protected function Returns the Database connection info to be used for this test. 2
KernelTestBase::getDatabasePrefix public function
KernelTestBase::getExtensionsForModules private function Returns Extension objects for $modules to install.
KernelTestBase::getModulesToEnable private static function Returns the modules to install for this test.
KernelTestBase::initFileCache protected function Initializes the FileCache component.
KernelTestBase::installConfig protected function Installs default configuration for a given list of modules.
KernelTestBase::installEntitySchema protected function Installs the storage schema for a specific entity type.
KernelTestBase::installSchema protected function Installs database tables from a module schema definition.
KernelTestBase::register public function Registers test-specific services. Overrides ServiceProviderInterface::register 27
KernelTestBase::render protected function Renders a render array. 1
KernelTestBase::setInstallProfile protected function Sets the install profile and rebuilds the container to update it.
KernelTestBase::setSetting protected function Sets an in-memory Settings variable.
KernelTestBase::setUpBeforeClass public static function 1
KernelTestBase::setUpFilesystem protected function Sets up the filesystem, so things like the file directory. 2
KernelTestBase::stop Deprecated protected function Stops test execution.
KernelTestBase::tearDown protected function 6
KernelTestBase::tearDownCloseDatabaseConnection public function @after
KernelTestBase::vfsDump protected function Dumps the current state of the virtual filesystem to STDOUT.
KernelTestBase::__get public function
KernelTestBase::__sleep public function Prevents serializing any properties.
PhpUnitWarnings::$deprecationWarnings private static property Deprecation warnings from PHPUnit to raise with @trigger_error().
PhpUnitWarnings::addWarning public function Converts PHPUnit deprecation warnings to E_USER_DEPRECATED.
QueryTest::testArrayArgumentsSQLInjection public function Tests SQL injection via database query array arguments.
QueryTest::testArraySubstitution public function Tests that we can pass an array of values directly in the query.
QueryTest::testConditionOperatorArgumentsSQLInjection public function Tests SQL injection via condition operator.
QueryTest::testNumericExpressionSubstitution public function Tests numeric query parameter expansion in expressions.
QueryTest::testQuotingIdentifiers public function Tests quoting identifiers in queries.
QueryTest::testReturnOptionDeprecation public function Tests deprecation of the 'return' query option.
QueryTest::testScalarSubstitution public function Tests that we can not pass a scalar value when an array is expected.
RandomGeneratorTrait::getRandomGenerator protected function Gets the random generator for the utility methods.
RandomGeneratorTrait::randomMachineName protected function Generates a unique random string containing letters and numbers.
RandomGeneratorTrait::randomObject public function Generates a random PHP object.
RandomGeneratorTrait::randomString public function Generates a pseudo-random string of ASCII characters of codes 32 to 126.
RandomGeneratorTrait::randomStringValidate Deprecated public function Callback for random string validation.
StorageCopyTrait::replaceStorageContents protected static function Copy the configuration from one storage to another and remove stale items.
TestRequirementsTrait::checkModuleRequirements Deprecated private function Checks missing module requirements.
TestRequirementsTrait::checkRequirements Deprecated protected function Check module requirements for the Drupal use case.
TestRequirementsTrait::getDrupalRoot protected static function Returns the Drupal root directory.

Buggy or inaccurate documentation? Please file an issue. Need support? Need help programming? Connect with the Drupal community.