SqlBuilder: tryDelimite() warns about unsupported string literals

Values belong in parameters. A literal written straight into a SQL fragment
is not recognized, so its content gets delimited as if it were an identifier
(name = 'abc' becomes [name] = '[abc]'), which silently returns wrong rows
instead of failing. Whether it happens at all depends on the content: 'x'
breaks, '!' does not, so the trap is impossible to guess.

Author: dg

src/Database/Table/SqlBuilder.php

@@ -922,9 +922,15 @@ protected function buildQueryEnd(): string
 
 	/**
 	 * Delimits lowercase identifiers in a SQL fragment while leaving uppercase keywords untouched.
+	 * String literals are not supported - values belong in parameters - and warn when present.
 	 */
 	protected function tryDelimite(string $s): string
 	{
+		if (str_contains($s, "'")) {
+			// the literal is not recognized and its content gets delimited as if it were an identifier
+			trigger_error("SQL string literals are not supported here, pass the value as a parameter instead: $s", E_USER_WARNING);
+		}
+
 		if (!$this->entityMapping) {
 			return preg_replace_callback(
 				'#(?<=[^\w`"\[?:]|^)[a-z_][a-z0-9_]*(?=[^\w`"(\]]|$)#Di',

tests/Database/Explorer/SqlBuilder.tryDelimite().phpt

@@ -24,3 +24,10 @@ Assert::same(reformat('HELLO([world])'), $tryDelimite->invoke($sqlBuilder, 'HELL
 Assert::same(reformat('hello([world])'), $tryDelimite->invoke($sqlBuilder, 'hello(world)'));
 Assert::same('[hello]', $tryDelimite->invoke($sqlBuilder, '[hello]'));
 Assert::same(reformat('::int'), $tryDelimite->invoke($sqlBuilder, '::int'));
+
+// string literals are not supported, the content would be delimited as an identifier
+Assert::error(
+	fn() => $tryDelimite->invoke($sqlBuilder, "name = 'abc'"),
+	E_USER_WARNING,
+	"SQL string literals are not supported here, pass the value as a parameter instead: name = 'abc'",
+);