prisma-client-php 0.0.20 → 0.0.21

package/dist/src/Lib/Prisma/Classes/PPHPUtility.php

@@ -335,7 +335,7 @@ final class PPHPUtility
                         } elseif ($val === '') {
                             $sqlConditions[] = "$qualifiedField != ''";
                         } else {
-                            $validatedValue = Validator::string($val);
+                            $validatedValue = Validator::string($val, false);
                             $likeOperator = $condition === 'contains' ? ($dbType == 'pgsql' ? 'ILIKE' : 'LIKE') : '=';
                             if ($condition === 'startsWith') $validatedValue .= '%';
                             if ($condition === 'endsWith') $validatedValue = '%' . $validatedValue;
@@ -355,7 +355,7 @@ final class PPHPUtility
                         } elseif (strtotime($val) !== false) {
                             $validatedValue = date('Y-m-d H:i:s', strtotime($val));
                         } else {
-                            $validatedValue = Validator::string($val);
+                            $validatedValue = Validator::string($val, false);
                         }
                         $operator = $condition === 'gt' ? '>' : ($condition === 'gte' ? '>=' : ($condition === 'lt' ? '<' : '<='));
                         $sqlConditions[] = "$qualifiedField $operator $bindingKey";
@@ -366,7 +366,7 @@ final class PPHPUtility
                         $inPlaceholders = [];
                         foreach ($val as $i => $inVal) {
                             $inKey = $bindingKey . "_" . $i;
-                            $validatedValue = Validator::string($inVal);
+                            $validatedValue = Validator::string($inVal, false);
                             $inPlaceholders[] = $inKey;
                             $bindings[$inKey] = $validatedValue;
                         }
@@ -386,7 +386,7 @@ final class PPHPUtility
                 $sqlConditions[] = "$qualifiedField = ''";
             } else {
                 $bindingKey = ":" . $prefix . $key . $level;
-                $validatedValue = Validator::string($value);
+                $validatedValue = Validator::string($value, false);
                 $sqlConditions[] = "$qualifiedField = $bindingKey";
                 $bindings[$bindingKey] = $validatedValue;
             }

package/dist/src/Lib/Validator.php

@@ -22,19 +22,25 @@ final class Validator
     /**
      * Validate and sanitize a string.
      *
-     * This function converts the input to a string, trims any leading or trailing 
-     * whitespace, and converts special characters to HTML entities to prevent 
-     * XSS attacks. If the input is null, an empty string is returned.
+     * This function converts the input to a string, trims any leading or trailing
+     * whitespace, and optionally converts special characters to HTML entities to 
+     * prevent XSS attacks. If the input is null, an empty string is returned.
      *
      * @param mixed $value The value to validate and sanitize. This can be of any type.
-     * @return string The sanitized string. If the input is not a string or null, it is converted to its string representation before sanitization. If the input is null, an empty string is returned.
+     * @param bool $escapeHtml Whether to escape special characters as HTML entities. 
+     *                         Defaults to true. Set to false when handling database 
+     *                         queries or other non-HTML contexts.
+     * @return string The sanitized string. If the input is not a string or null, 
+     *                it is converted to its string representation before sanitization. 
+     *                If the input is null, an empty string is returned.
      */
-    public static function string($value): string
+    public static function string($value, bool $escapeHtml = true): string
     {
         // Convert the value to a string if it's not null
         $stringValue = $value !== null ? (string)$value : '';
-        // Return the HTML-escaped string
-        return htmlspecialchars(trim($stringValue), ENT_QUOTES, 'UTF-8');
+
+        // If escaping is enabled, apply htmlspecialchars; otherwise, just trim
+        return $escapeHtml ? htmlspecialchars(trim($stringValue), ENT_QUOTES, 'UTF-8') : trim($stringValue);
     }
 
     /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "prisma-client-php",
   "description": "Prisma Client PHP is an auto-generated query builder that enables type-safe database access in PHP.",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "main": "index.js",
   "type": "module",
   "scripts": {