[#11236] Set parameter type in QBMapper

Signed-off-by: Marius David Wieschollek <git.public@mdns.eu>

1 files changed, 35 insertions, 3 deletions

diff --git a/lib/public/AppFramework/Db/QBMapper.php b/lib/public/AppFramework/Db/QBMapper.php
index a6a44b8902e..8b0bab7895f 100644
--- a/lib/public/AppFramework/Db/QBMapper.php
+++ b/lib/public/AppFramework/Db/QBMapper.php
@@ -114,7 +114,8 @@ abstract class QBMapper {
 			$getter = 'get' . ucfirst($property);
 			$value = $entity->$getter();
 
-			$qb->setValue($column, $qb->createNamedParameter($value));
+			$type = $this->getParameterTypeForProperty($entity, $property);
+			$qb->setValue($column, $qb->createNamedParameter($value, $type));
 		}
 
 		$qb->execute();
@@ -181,11 +182,12 @@ abstract class QBMapper {
 			$getter = 'get' . ucfirst($property);
 			$value = $entity->$getter();
 
-			$qb->set($column, $qb->createNamedParameter($value));
+			$type = $this->getParameterTypeForProperty($entity, $property);
+			$qb->set($column, $qb->createNamedParameter($value, $type));
 		}
 
 		$qb->where(
-			$qb->expr()->eq('id', $qb->createNamedParameter($id))
+			$qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT))
 		);
 		$qb->execute();
 
@@ -193,6 +195,36 @@ abstract class QBMapper {
 	}
 
 	/**
+	 * Returns the type parameter for the QueryBuilder for a specific property
+	 * of the $entity
+	 *
+	 * @param Entity $entity   The entity to get the types from
+	 * @param string $property The property of $entity to get the type for
+	 * @return int
+	 * @since 16.0.0
+	 */
+	protected function getParameterTypeForProperty(Entity $entity, string $property): int {
+		$types = $entity->getFieldTypes();
+
+		if(!isset($types[ $property ])) {
+			return IQueryBuilder::PARAM_STR;
+		}
+
+		switch($types[ $property ]) {
+			case 'int':
+			case 'integer':
+				return IQueryBuilder::PARAM_INT;
+			case 'string':
+				return IQueryBuilder::PARAM_STR;
+			case 'bool':
+			case 'boolean':
+				return IQueryBuilder::PARAM_BOOL;
+		}
+
+		return IQueryBuilder::PARAM_STR;
+	}
+
+	/**
 	 * Returns an db result and throws exceptions when there are more or less
 	 * results
 	 *