Question

Environment: PHP 5.3

I’m trying to write my own query parameter substitution method. Basically I want to take this:

select * from xxx where a=? and b>?

and convert it to

select * from xxx where a=1 and b>2

Naturally, assuming that values for all the ? parameters are known. OK, so that’s a bit simplified, but enough for the question.

So, what I need to do, is to find all the ? marks in the given string. Easy, right? But there’s one catch: I don’t want to find the marks that are inside strings or comments. So, in this string:

select *  -- I know * is bad, but just once can't hurt, right?
from xxx /* ? */ where a=? and b='Question?'

Only one of the ? marks should be replaced.

My intuition tells me that PHP’s preg_replace() should be up to the task… but my regex knowledge fails me in constructing an appropriate pattern. 🙁 I could also just parse it “by hand”, but I’m worried that the performance will take an inappropriate hit.

So – can this be done quickly via regexes (and if yes, what would be the pattern), or should I just parse it manually character-by-character?

Answer 1

This is a difficult problem for regexes. A parser would be more suitable, but as long as certain constraints are met, regexes might just work. The constraints are:

• no nested comments
• no escaped quotes inside strings
• no single quotes inside comments
• no comment delimiters inside strings
• all quotes and comments are correctly balanced
• there is a maximum line length that you can specify

If those are the case, then you can simply look for a ? that is

• not preceded (on the same line) by --.
• not followed by */ unless /* occurs first and
• followed by an even number of quotes,

Assuming a maximum line length of 100, this gives you

$result = preg_replace(
    '%(?<!--.{0,100})    # Assert no -- preceding on this line
    \?                   # Match a ?
    (?!                  # Assert that it\'s impossible to match...
     (?s:                #  (allowing the dot to match newlines here):
      (?!/\*)            #  (and making sure there is no intervening /*)
      .                  #  any character
     )*                  # zero or more times, if that string is followed by
     \*/                 # */
    )                    # End of lookahead
    (?=                  # Assert that it *is* possible to match
     (?:                 # the following regex:
      [^\']*\'[^\']*\'   #  a string containing exactly two quotes
     )*                  #  repeated zero or more times
     [^\']*              # followed by only non-quote characters
     $                   # until the end of the string.
    )                    # End of lookahead.
    %x', 
    'REPLACE', $subject);