fix: clear bindings when resetting compiled queries

system/Database/BaseBuilder.php

@@ -2095,13 +2095,15 @@ public function getSetData(bool $clean = false): array
      */
     public function getCompiledSelect(bool $reset = true): string
     {
-        $select = $this->compileSelect();
+        $select = $this->compileFinalQuery($this->compileSelect());
 
         if ($reset) {
             $this->resetSelect();
+            $this->binds         = [];
+            $this->bindsKeyCount = [];
         }
 
-        return $this->compileFinalQuery($select);
+        return $select;
     }
 
     /**
@@ -2939,11 +2941,15 @@ public function getCompiledInsert(bool $reset = true)
             array_values($this->QBSet),
         );
 
+        $sql = $this->compileFinalQuery($sql);
+
         if ($reset) {
             $this->resetWrite();
+            $this->binds         = [];
+            $this->bindsKeyCount = [];
         }
 
-        return $this->compileFinalQuery($sql);
+        return $sql;
     }
 
     /**
@@ -3110,11 +3116,15 @@ public function getCompiledUpdate(bool $reset = true)
 
         $sql = $this->_update($this->QBFrom[0], $this->QBSet);
 
+        $sql = $this->compileFinalQuery($sql);
+
         if ($reset) {
             $this->resetWrite();
+            $this->binds         = [];
+            $this->bindsKeyCount = [];
         }
 
-        return $this->compileFinalQuery($sql);
+        return $sql;
     }
 
     /**
@@ -3417,8 +3427,14 @@ public function getCompiledDelete(bool $reset = true): string
     {
         $sql = $this->testMode()->delete('', null, $reset);
         $this->testMode(false);
+        $sql = $this->compileFinalQuery($sql);
 
-        return $this->compileFinalQuery($sql);
+        if ($reset) {
+            $this->binds         = [];
+            $this->bindsKeyCount = [];
+        }
+
+        return $sql;
     }
 
     /**

tests/system/Database/Builder/BindingLifecycleTest.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * This file is part of CodeIgniter 4 framework.
+ *
+ * (c) CodeIgniter Foundation <[email protected]>
+ *
+ * For the full copyright and license information, please view
+ * the LICENSE file that was distributed with this source code.
+ */
+
+namespace CodeIgniter\Database\Builder;
+
+use CodeIgniter\Database\BaseBuilder;
+use CodeIgniter\Test\CIUnitTestCase;
+use CodeIgniter\Test\Mock\MockConnection;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Group;
+
+/**
+ * @internal
+ */
+#[Group('Others')]
+final class BindingLifecycleTest extends CIUnitTestCase
+{
+    #[DataProvider('provideCompiledQuery')]
+    public function testCompiledQueryClearsBindingsOnReset(string $method, string $sql): void
+    {
+        $builder = new BaseBuilder('jobs', new MockConnection([]));
+
+        for ($id = 1; $id <= 3; $id++) {
+            $this->prepareQuery($builder, $method, $id);
+
+            $this->assertSameSql(sprintf($sql, $id), $builder->{$method}());
+            $this->assertSame([], $builder->getBinds());
+        }
+    }
+
+    #[DataProvider('provideCompiledQuery')]
+    public function testCompiledQueryPreservesBindingsWithoutReset(string $method, string $sql): void
+    {
+        $builder = new BaseBuilder('jobs', new MockConnection([]));
+        $this->prepareQuery($builder, $method, 1);
+        $binds = $builder->getBinds();
+
+        for ($i = 0; $i < 2; $i++) {
+            $this->assertSameSql(sprintf($sql, 1), $builder->{$method}(false));
+            $this->assertSame($binds, $builder->getBinds());
+        }
+
+        $this->assertSameSql(sprintf($sql, 1), $builder->{$method}());
+        $this->assertSame([], $builder->getBinds());
+    }
+
+    /**
+     * @return iterable<string, array{string, string}>
+     */
+    public static function provideCompiledQuery(): iterable
+    {
+        yield 'select' => ['getCompiledSelect', 'SELECT * FROM "jobs" WHERE "id" = %d'];
+
+        yield 'insert' => ['getCompiledInsert', 'INSERT INTO "jobs" ("name", "id") VALUES (\'O\'\'Reilly\', %d)'];
+
+        yield 'update' => ['getCompiledUpdate', 'UPDATE "jobs" SET "name" = \'O\'\'Reilly\' WHERE "id" = %d'];
+
+        yield 'delete' => ['getCompiledDelete', 'DELETE FROM "jobs" WHERE "id" = %d'];
+    }
+
+    private function prepareQuery(BaseBuilder $builder, string $method, int $id): void
+    {
+        if ($method === 'getCompiledInsert' || $method === 'getCompiledUpdate') {
+            $builder->set('name', "O'Reilly");
+        }
+
+        if ($method === 'getCompiledInsert') {
+            $builder->set('id', $id);
+        } else {
+            $builder->where('id', $id);
+        }
+    }
+}

tests/system/Database/Builder/GroupTest.php

@@ -94,7 +94,7 @@ public function testHavingBetweenMethods(string $method, string $sql): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -172,7 +172,7 @@ public function testHavingBetweenNoEscape(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 

tests/system/Database/Builder/InsertTest.php

@@ -57,7 +57,7 @@ public function testInsertArray(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledInsert());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledInsert(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -111,7 +111,7 @@ public function testInsertObject(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledInsert());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledInsert(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -155,7 +155,7 @@ public function testInsertWithTableAlias(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledInsert());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledInsert(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 

tests/system/Database/Builder/LikeTest.php

@@ -50,7 +50,7 @@ public function testSimpleLike(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -72,7 +72,7 @@ public function testLikeAny(): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, (string) preg_replace('/\s+/', ' ', trim($builder->getCompiledSelect())));
+        $this->assertSame($expectedSQL, (string) preg_replace('/\s+/', ' ', trim($builder->getCompiledSelect(false))));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -118,7 +118,7 @@ public function testLikeAnyCaseInsensitiveSearch(): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, (string) preg_replace('/\s+/', ' ', trim($builder->getCompiledSelect())));
+        $this->assertSame($expectedSQL, (string) preg_replace('/\s+/', ' ', trim($builder->getCompiledSelect(false))));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -141,7 +141,7 @@ public function testLikeAnyWithRawSqlField(): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, (string) preg_replace('/\s+/', ' ', trim($builder->getCompiledSelect())));
+        $this->assertSame($expectedSQL, (string) preg_replace('/\s+/', ' ', trim($builder->getCompiledSelect(false))));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -191,7 +191,7 @@ public function testLikeWithRawSql(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -209,7 +209,7 @@ public function testLikeNoSide(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -227,7 +227,7 @@ public function testLikeBeforeOnly(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -245,7 +245,7 @@ public function testLikeAfterOnly(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -267,7 +267,7 @@ public function testOrLike(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -285,7 +285,7 @@ public function testNotLike(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -307,7 +307,7 @@ public function testOrNotLike(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -325,7 +325,7 @@ public function testCaseInsensitiveLike(): void
             ],
         ];
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -348,7 +348,7 @@ public function testDBPrefixAndCoulmnWithTablename(): void
                 true,
             ],
         ];
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -373,7 +373,7 @@ public function testLikeMultipleFields(): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect()));
+        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect(false)));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -398,7 +398,7 @@ public function testLikeMultipleCallsWithRawSqlAndString(): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect()));
+        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect(false)));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -423,7 +423,7 @@ public function testOrLikeMultipleFields(): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect()));
+        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect(false)));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 
@@ -445,7 +445,7 @@ public function testLikeMethodsWithEmptyArray(string $method): void
             ],
         ];
 
-        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect()));
+        $this->assertSame($expectedSQL, str_replace("\n", ' ', $builder->getCompiledSelect(false)));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }
 

tests/system/Database/Builder/PrefixTest.php

@@ -86,7 +86,7 @@ public function testPrefixesSetOnTableNamesWithWhereBetweenClause(): void
 
         $builder->whereBetween('users.created_at', [1, 10]);
 
-        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect());
+        $this->assertSameSql($expectedSQL, $builder->getCompiledSelect(false));
         $this->assertSame($expectedBinds, $builder->getBinds());
     }