tylerhall/simple-php-framework — Issue #7: quotation of mysql LIMIT arguments
Author: Gert-Jan
Created: 2011-11-25 10:32:54+00:00
State: open

Using arguments on the SQL LIMIT statement and passing that in the class.database.php query function results in a SQL syntax error (at least for mysql).

This happens because it this produces queries such as:
```SELECT * FROM MyTable LIMIT '0', '10';
```
Quotations are not allowed as arguments for the LIMIT statement because only actual int values are expected there.

Now for obvious reasons the quotations are vital in the query function.
For now I fixed this issue by changing the following line (124, in class.database.php):
```$val = $this->quote($val);
```
to this:
```if (!is_int($val)) $val = $this->quote($val);
```

This should still prevent any kind of injection, but I am curious if there is a better solution.