LIKE ESCAPE and QueryBuilder::createNamedParameter

[DeepDiver1975]

Steps to reproduce

1. use like() and createNamedParameter() with a pattern which holds a wildcard (e.g. _) and escapeLikeParameter
2. run query on a data set which matches the pattern

Expected behaviour

the record shall be within the result set

Actual behaviour

the record is not in the result set

Server configuration

Database:
all

ownCloud version: (see ownCloud admin page)
10.0.x and master are affected

[DeepDiver1975]

Analysis

Queries which use ? as placeholder are working because the necessary ESCAPE key word is added in the adapters:

core/lib/private/DB/AdapterSqlite.php

Line 42 in 6b36c56

$statement = \preg_replace('( I?LIKE \?)', '$0 ESCAPE \'\\\'', $statement);

The regex does not match in case of queries which have been built using createNamesParameter() because :dcValue is used as placeholder.

[DeepDiver1975]

With dbal 2.8.0 the escape char can be specified in the like() method - potential fix approach for master: #32372

stable10 uses a different dbal version - we cannot yet update because of php version requirements

[DeepDiver1975]

for stable10 we could add ESCAPE within the expression builder like manually

[DeepDiver1975]

never the less the tricky part is to make sure the queries which do not use the querybuilder get the proper ESCAPE added

[ownclouders]

GitMate.io thinks possibly related issues are #32372 (Add escape character to like query), #16580 (LIKE queries do not properly escape special characters), #17862 (Prefix QueryBuilder stuff with PREFIX), #3494 (Property Serializer Escaping Issue), and #9046 (escape t() variables by default).

[DeepDiver1975]

seems like the easiest fix is to convert all createNamedParameter() into createPositionalParameter()