Quote database names in PostgreSQL and SQL Server adapters#1002
Merged
Quote database names in PostgreSQL and SQL Server adapters#1002
Conversation
MySQL adapter properly quotes database names in createDatabase/dropDatabase using quoteTableName(), but PostgreSQL and SQL Server did not. - PostgreSQL: Use quoteSchemaName() for database name and quoteString() for charset - SQL Server: Use quoteSchemaName() for database name and quoteString() for string comparisons This ensures consistent identifier quoting across all database adapters.
dereuromark
added a commit
that referenced
this pull request
Jan 20, 2026
This backports several important bug fixes from recent 5.x PRs: **From PR #1001 (Fix release readiness issues for 5.x):** - Fix copy-paste bug in Migrator::shouldDropTables() using $messages['down'] instead of $messages['missing'] - Fix uninitialized $command property in Migrations.php - Fix weak equality in Table::saveData() (use !== instead of !=) - Replace assert() with explicit RuntimeException in BaseSeed for production safety - Fix DumpCommand using non-existent $io->error() method (should be $io->err()) - Replace unsafe addslashes() with proper driver escaping (schemaValue()) for column comments in MysqlAdapter::getRenameColumnInstructions() **From PR #1002 (Quote database names in PostgreSQL and SQL Server adapters):** - PostgresAdapter: Quote database name and charset in createDatabase() - PostgresAdapter: Quote database name in dropDatabase() - SqlserverAdapter: Use quoteSchemaName() instead of manual brackets in createDatabase() and dropDatabase() - SqlserverAdapter: Fix SQL injection vulnerability in dropDatabase() **From PR #1003 (Improve SQL quoting and fix docblock issues):** - SqlserverAdapter: Use quoteString() for sp_rename parameters in getRenameTableInstructions() and getRenameColumnInstructions() - PostgresAdapter/SqlserverAdapter: Use quoteColumnName() for foreign key column definitions instead of hard-coded double quotes
markstory
pushed a commit
that referenced
this pull request
Jan 21, 2026
This backports several important bug fixes from recent 5.x PRs: **From PR #1001 (Fix release readiness issues for 5.x):** - Fix copy-paste bug in Migrator::shouldDropTables() using $messages['down'] instead of $messages['missing'] - Fix uninitialized $command property in Migrations.php - Fix weak equality in Table::saveData() (use !== instead of !=) - Replace assert() with explicit RuntimeException in BaseSeed for production safety - Fix DumpCommand using non-existent $io->error() method (should be $io->err()) - Replace unsafe addslashes() with proper driver escaping (schemaValue()) for column comments in MysqlAdapter::getRenameColumnInstructions() **From PR #1002 (Quote database names in PostgreSQL and SQL Server adapters):** - PostgresAdapter: Quote database name and charset in createDatabase() - PostgresAdapter: Quote database name in dropDatabase() - SqlserverAdapter: Use quoteSchemaName() instead of manual brackets in createDatabase() and dropDatabase() - SqlserverAdapter: Fix SQL injection vulnerability in dropDatabase() **From PR #1003 (Improve SQL quoting and fix docblock issues):** - SqlserverAdapter: Use quoteString() for sp_rename parameters in getRenameTableInstructions() and getRenameColumnInstructions() - PostgresAdapter/SqlserverAdapter: Use quoteColumnName() for foreign key column definitions instead of hard-coded double quotes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createDatabase()anddropDatabase()usingquoteTableName(), but PostgreSQL and SQL Server did not quote these identifiers consistently.PostgreSQL fixes:
createDatabase(): UsequoteSchemaName()for database name andquoteString()for charset encodingdropDatabase(): UsequoteSchemaName()for database nameSQL Server fixes:
createDatabase(): UsequoteSchemaName()for database name and collation instead of manual[brackets]dropDatabase(): Replace heredoc with sprintf usingquoteSchemaName()for identifiers andquoteString()for string comparisonsDocblock fixes:
@paramstypo to@paraminBaseMigration.phpforeignKey()andindex()methodsThis ensures consistent identifier quoting across all database adapters and fixes documentation errors.
Test plan