Skip to content

Correctly encode array for native param binding#257

Merged
isublimity merged 1 commit intosmi2:masterfrom
sander-hash:bug/incorrect-encoding-for-array
Apr 16, 2026
Merged

Correctly encode array for native param binding#257
isublimity merged 1 commit intosmi2:masterfrom
sander-hash:bug/incorrect-encoding-for-array

Conversation

@sander-hash
Copy link
Copy Markdown
Contributor

@sander-hash sander-hash commented Apr 16, 2026

Fix incorrect array encoding for native parameter binding

Problem

When passing an Array type to selectWithParams() or writeWithParams(), the previous implementation serialized the array using json_encode():

  if (is_array($value)) {
      return json_encode($value);
  }

This produced JSON encoding — double-quoted strings and JSON syntax:

["foo","bar","baz"]

ClickHouse's native HTTP parameter protocol expects array literals with single-quoted strings:

['foo','bar','baz']

The double-quoted output caused a query error when executing any native param query with a Array(String) parameter.

Fix

Replaced json_encode with a recursive approach that delegates each element back through convertParamValue(), with a special case for string elements which are wrapped in single
quotes:

  if (is_array($value)) {
      $arrayValues = [];
      foreach ($value as $val) {
          if (is_string($val)) {
              $arrayValues[] = sprintf("'%s'", $val);
              continue;
          }
          $arrayValues[] = $this->convertParamValue($val);
      }
      return sprintf('[%s]', implode(',', $arrayValues));
  }

This correctly handles:

  • Array(String) → ['foo','bar']
  • Array(UInt32) → [1,2,3]
  • Array(Array(...)) — nested arrays via recursion

@isublimity isublimity merged commit 04623c0 into smi2:master Apr 16, 2026
2 of 13 checks passed
@isublimity
Copy link
Copy Markdown
Contributor

Thanks a lot for the fix — really useful catch! 🎉 The json_encode() vs ClickHouse single-quote format mismatch was a real problem.

Merged to master. I'll add a follow-up commit to escape single quotes and backslashes inside array strings (e.g. ["it's"]), since sprintf("'%s'", $val) doesn't handle those cases yet. Plus additional tests covering these edge cases.

isublimity added a commit that referenced this pull request Apr 16, 2026
Follow-up to #257: properly escape single quotes and backslashes in
Array(String) native parameter values to prevent query errors and
array-element injection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants