使用typo3中的函数更新查询

Question

I'm trying to use the typo3 update function with the mysql CONCAT function. Can you tell me how to manage that? What I tried:

$updateArray = array("field" => 'CONCAT( field'.','.$toAppend.')');
$GLOBALS['TYPO3_DB']->exec_UPDATEquery ('table','id = '.'"'.$some_id.'"',$updateArray);

That does not work, because that query is executed:

UPDATE table
SET
pagesEdited='CONCAT( field,'value')'
WHERE
id = "id"

As you see, the concat function is escaped.

Answer 1

The reference documentation isn't very clear about it, however, just appending TRUE to your parameters of the update function should disable quoting:

$GLOBALS['TYPO3_DB']->exec_UPDATEquery ('table','id = '.'"'.$some_id.'"',$updateArray, TRUE);

That also means that you will have to do your own input sanitization before lauching the query, if you haven't already:

$toAppend = $GLOBALS['TYPO3_DB']->fullQuoteString($toAppend, "");

Answer 2

Have a look at the noQuote parameter of the fullQuoteArray() method of TYPO3\\CMS\\Core\\Database\\DatabaseConnection that is used by exec_UPDATEquery() :

@param boolean|array $noQuote List/array of keys NOT to quote (eg. SQL functions) - ONLY for associative arrays

And when you take a kloser look ath this method, you will see that a simple true does not do the trick as expected. Simply use a list of fields (comma separated list) or an array to let TYPO3 know which fields should not be escaped.

In your case it would look like this:

$updateArray = array(
    'field' => 'CONCAT(field,' . $GLOBALS['TYPO3_DB']->fullQuoteString($toAppend, 'table') . ')',
);
$where = 'id = ' . $GLOBALS['TYPO3_DB']->fullQuoteString($some_id, 'table');

$GLOBALS['TYPO3_DB']->exec_UPDATEquery ('table', $where, $updateArray, 'field');