Skip to content

fix(Database): escape table identifiers in SQLite3 foreign_key_list PRAGMA #10732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gr8man wants to merge 2 commits into
base: develop
Choose a base branch
from
+180 −1
Open

fix(Database): escape table identifiers in SQLite3 foreign_key_list PRAGMA #10732

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6e0a6f8
fix(Database): escape table identifiers in SQLite3 foreign_key_list P…
gr8man Nov 5, 2026
7da8053
fix: properly escape table name and schema in SQLite3 getForeignKeyData
gr8man Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/changelogs/v4.7.7.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ Release Date: Unreleased
## Bugs Fixed

- **CORS:** Fixed a bug where `Cors::hasResponseHeaders()` matched header substrings via `str_contains()`, causing false positives when existing exposed headers shared a prefix with configured exposed headers.
- **Database:** Fixed a bug where `SQLite3\Connection::_foreignKeyData()` did not escape table identifiers in `PRAGMA foreign_key_list`, causing syntax errors on table names containing hyphens or schemas.
- **HTTP:** Fixed a bug where `UploadedFile::move()` and `UploadedFile::store()` on Windows could store a file under a different name than `getName()` reported, or write its contents to an NTFS alternate data stream. Filenames ending in a period or space or containing a colon are now rejected, including explicitly supplied names.
- **Security:** Fixed a bug where `Security::__construct()` threw a `TypeError` when the CSRF cookie was an array, causing an HTTP 500 response for affected requests.
- **Worker Mode:** Fixed a bug where every request that ended with an uncaught exception, including a `404 Page Not Found` without a 404 override, called `exit()` in the exception handler. This ended the worker script, so FrankenPHP booted a new one, and the worker loop skipped its cleanup after the request. The exception handler now returns to the worker loop.
Expand Down
8 changes: 7 additions & 1 deletion system/Database/SQLite3/Connection.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,7 +363,13 @@ protected function _foreignKeyData(string $table): array
return [];
}

$query = $this->query("PRAGMA foreign_key_list({$table})")->getResult();
$parts = explode('.', $table);
$tableName = array_pop($parts);

@neznaika0 neznaika0 Nov 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It’s questionable, but the option works.

$schema = array_pop($parts);
$pragma = ($schema === null || $schema === '' ? '' : $this->escapeIdentifier($schema) . '.')
. 'foreign_key_list(' . $this->escape($tableName) . ')';

$query = $this->query('PRAGMA ' . $pragma)->getResult();
$indexes = [];

foreach ($query as $row) {
Expand Down
172 changes: 172 additions & 0 deletions tests/system/Database/Live/SQLite3/GetForeignKeyDataTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,172 @@
<?php

declare(strict_types=1);

/**
* This file is part of CodeIgniter 4 framework.
*
* (c) CodeIgniter Foundation <admin@codeigniter.com>
*
* For the full copyright and license information, please view
* the LICENSE file that was distributed with this source code.
*/

namespace CodeIgniter\Database\Live\SQLite3;

use CodeIgniter\Test\CIUnitTestCase;
use Config\Database;
use PHPUnit\Framework\Attributes\Group;

/**
* @internal
*/
#[Group('DatabaseLive')]
final class GetForeignKeyDataTest extends CIUnitTestCase
{
protected function setUp(): void
{
parent::setUp();

$this->db = Database::connect($this->DBGroup);
if ($this->db->DBDriver !== 'SQLite3') {
$this->markTestSkipped('This test is only for SQLite3.');
}

$config = [
'DBDriver' => 'SQLite3',
'database' => 'database.db',
'DBDebug' => true,
];
$this->db = db_connect($config, false);
}

public function testGetForeignKeyDataWithSpecialTableName(): void
{
$this->db->query('DROP TABLE IF EXISTS `test-parent`');
$this->db->query('DROP TABLE IF EXISTS `test-child`');

$this->db->query('CREATE TABLE `test-parent` (id INTEGER PRIMARY KEY)');
$this->db->query('CREATE TABLE `test-child` (id INTEGER PRIMARY KEY, parent_id INTEGER, FOREIGN KEY (parent_id) REFERENCES `test-parent`(id))');

$foreignKeys = $this->db->getForeignKeyData('test-child');

@neznaika0 neznaika0 Nov 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In all tests, double cleaning of the tables makes no sense. I suggest performing the cleaning after getForeignKeyData().
If the check fails, the data will already be cleaned. In case of an error before the test, this will indicate that the previous broken test needs to be found.

Don’t forget the order — first delete the child tables, then the parent, and deattach.


$this->assertCount(1, $foreignKeys);
$firstKey = reset($foreignKeys);
$this->assertSame('test-child', $firstKey->table_name);
$this->assertSame(['parent_id'], $firstKey->column_name);
$this->assertSame('test-parent', $firstKey->foreign_table_name);
$this->assertSame(['id'], $firstKey->foreign_column_name);

$this->db->query('DROP TABLE IF EXISTS `test-child`');
$this->db->query('DROP TABLE IF EXISTS `test-parent`');
}

public function testGetForeignKeyDataWithAttachedDatabase(): void
{
$this->db->query('ATTACH DATABASE ":memory:" AS `test_schema`');
$this->db->query('DROP TABLE IF EXISTS `test_schema`.`attached-parent`');
$this->db->query('DROP TABLE IF EXISTS `test_schema`.`attached-child`');

$this->db->query('CREATE TABLE `test_schema`.`attached-parent` (id INTEGER PRIMARY KEY)');
$this->db->query('CREATE TABLE `test_schema`.`attached-child` (id INTEGER PRIMARY KEY, p_id INTEGER, FOREIGN KEY (p_id) REFERENCES `attached-parent`(id))');

$foreignKeys = $this->db->getForeignKeyData('test_schema.attached-child');

$this->assertCount(1, $foreignKeys);
$firstKey = reset($foreignKeys);
$this->assertSame('test_schema.attached-child', $firstKey->table_name);
$this->assertSame(['p_id'], $firstKey->column_name);
$this->assertSame('attached-parent', $firstKey->foreign_table_name);
$this->assertSame(['id'], $firstKey->foreign_column_name);

$this->db->query('DROP TABLE IF EXISTS `test_schema`.`attached-child`');
$this->db->query('DROP TABLE IF EXISTS `test_schema`.`attached-parent`');
$this->db->query('DETACH DATABASE `test_schema`');
}

public function testGetForeignKeyDataWithParenthesesInTableName(): void
{
$this->db->query('DROP TABLE IF EXISTS "parent(v1)"');
$this->db->query('DROP TABLE IF EXISTS "child(v2)"');

$this->db->query('CREATE TABLE "parent(v1)" (id INTEGER PRIMARY KEY)');
$this->db->query('CREATE TABLE "child(v2)" (id INTEGER PRIMARY KEY, parent_id INTEGER, FOREIGN KEY (parent_id) REFERENCES "parent(v1)"(id))');

$foreignKeys = $this->db->getForeignKeyData('child(v2)');

$this->assertCount(1, $foreignKeys);
$firstKey = reset($foreignKeys);
$this->assertSame('child(v2)', $firstKey->table_name);
$this->assertSame(['parent_id'], $firstKey->column_name);
$this->assertSame('parent(v1)', $firstKey->foreign_table_name);
$this->assertSame(['id'], $firstKey->foreign_column_name);

$this->db->query('DROP TABLE IF EXISTS "child(v2)"');
$this->db->query('DROP TABLE IF EXISTS "parent(v1)"');
}

public function testGetForeignKeyDataWithQuotesAndSpacesInTableName(): void
{
$this->db->query('DROP TABLE IF EXISTS "parent table"');
$this->db->query('DROP TABLE IF EXISTS "child\'quote with space"');

$this->db->query('CREATE TABLE "parent table" (id INTEGER PRIMARY KEY)');
$this->db->query('CREATE TABLE "child\'quote with space" (id INTEGER PRIMARY KEY, p_id INTEGER, FOREIGN KEY (p_id) REFERENCES "parent table"(id))');

$foreignKeys = $this->db->getForeignKeyData("child'quote with space");

$this->assertCount(1, $foreignKeys);
$firstKey = reset($foreignKeys);
$this->assertSame("child'quote with space", $firstKey->table_name);
$this->assertSame(['p_id'], $firstKey->column_name);
$this->assertSame('parent table', $firstKey->foreign_table_name);
$this->assertSame(['id'], $firstKey->foreign_column_name);

$this->db->query('DROP TABLE IF EXISTS "child\'quote with space"');
$this->db->query('DROP TABLE IF EXISTS "parent table"');
}

public function testGetForeignKeyDataWithNumericAndReservedWordTableName(): void
{
$this->db->query('DROP TABLE IF EXISTS "order"');
$this->db->query('DROP TABLE IF EXISTS "12345"');

$this->db->query('CREATE TABLE "order" (id INTEGER PRIMARY KEY)');
$this->db->query('CREATE TABLE "12345" (id INTEGER PRIMARY KEY, order_id INTEGER, FOREIGN KEY (order_id) REFERENCES "order"(id))');

$foreignKeys = $this->db->getForeignKeyData('12345');

$this->assertCount(1, $foreignKeys);
$firstKey = reset($foreignKeys);
$this->assertSame('12345', $firstKey->table_name);
$this->assertSame(['order_id'], $firstKey->column_name);
$this->assertSame('order', $firstKey->foreign_table_name);
$this->assertSame(['id'], $firstKey->foreign_column_name);

$this->db->query('DROP TABLE IF EXISTS "12345"');
$this->db->query('DROP TABLE IF EXISTS "order"');
}

public function testGetForeignKeyDataWithAttachedDatabaseSpecialIdentifiers(): void
{
$this->db->query('ATTACH DATABASE ":memory:" AS "schema-db(1)"');
$this->db->query('DROP TABLE IF EXISTS "schema-db(1)"."parent(v1)"');
$this->db->query('DROP TABLE IF EXISTS "schema-db(1)"."child(v2)"');

$this->db->query('CREATE TABLE "schema-db(1)"."parent(v1)" (id INTEGER PRIMARY KEY)');
$this->db->query('CREATE TABLE "schema-db(1)"."child(v2)" (id INTEGER PRIMARY KEY, p_id INTEGER, FOREIGN KEY (p_id) REFERENCES "parent(v1)"(id))');

$foreignKeys = $this->db->getForeignKeyData('schema-db(1).child(v2)');

$this->assertCount(1, $foreignKeys);
$firstKey = reset($foreignKeys);
$this->assertSame('schema-db(1).child(v2)', $firstKey->table_name);
$this->assertSame(['p_id'], $firstKey->column_name);
$this->assertSame('parent(v1)', $firstKey->foreign_table_name);
$this->assertSame(['id'], $firstKey->foreign_column_name);

$this->db->query('DROP TABLE IF EXISTS "schema-db(1)"."child(v2)"');
$this->db->query('DROP TABLE IF EXISTS "schema-db(1)"."parent(v1)"');
$this->db->query('DETACH DATABASE "schema-db(1)"');
}
}
Loading