fix(Database): escape table string in SQLSRV Builder::_upsertBatch() Object_ID

docs/changelogs/v4.7.7.md

@@ -14,6 +14,7 @@ Release Date: Unreleased
 
 ## Bugs Fixed
 
+- **Database:** Fixed a bug where `SQLSRV\Builder::_upsertBatch()` concatenated `$table` unescaped into `Object_ID()`, causing syntax errors for table names with quotes or special characters.
 - **Security:** Fixed a bug where `Security::__construct()` threw a `TypeError` when the CSRF cookie was an array, causing an HTTP 500 response for affected requests.
 - **Worker Mode:** Fixed a bug where every request that ended with an uncaught exception, including a `404 Page Not Found` without a 404 override, called `exit()` in the exception handler. This ended the worker script, so FrankenPHP booted a new one, and the worker loop skipped its cleanup after the request. The exception handler now returns to the worker loop.
 

system/Database/SQLSRV/Builder.php

@@ -685,7 +685,7 @@ protected function _upsertBatch(string $table, array $keys, array $values): stri
             $constraints = $this->QBOptions['constraints'] ?? [];
 
             $tableIdentity = $this->QBOptions['tableIdentity'] ?? '';
-            $sql           = "SELECT name from syscolumns where id = Object_ID('" . $table . "') and colstat = 1";
+            $sql           = 'SELECT name from syscolumns where id = Object_ID(' . $this->db->escape($table) . ') and colstat = 1';
             if (($query = $this->db->query($sql)) === false) {
                 throw new DatabaseException('Failed to get table identity');
             }

tests/system/Database/Builder/SQLSRVBuilderTest.php

@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * This file is part of CodeIgniter 4 framework.
+ *
+ * (c) CodeIgniter Foundation <admin@codeigniter.com>
+ *
+ * For the full copyright and license information, please view
+ * the LICENSE file that was distributed with this source code.
+ */
+
+namespace CodeIgniter\Database\Builder;
+
+use CodeIgniter\Database\SQLSRV\Builder;
+use CodeIgniter\Test\CIUnitTestCase;
+use CodeIgniter\Test\Mock\MockConnection;
+use PHPUnit\Framework\Attributes\Group;
+use ReflectionMethod;
+use Throwable;
+
+/**
+ * @internal
+ */
+#[Group('Others')]
+final class SQLSRVBuilderTest extends CIUnitTestCase
+{
+    public function testUpsertBatchEscapesTableNameInObjectID(): void
+    {
+        $db      = new MockConnection(['DBDriver' => 'SQLSRV']);
+        $builder = new Builder("user's", $db);
+
+        $method = new ReflectionMethod($builder, '_upsertBatch');
+
+        try {
+            $method->invoke($builder, "user's", ['id', 'name'], [['1', 'Alice']]);
+        } catch (Throwable) {
+        }
+
+        $this->assertSame(
+            "SELECT name from syscolumns where id = Object_ID('user''s') and colstat = 1",
+            (string) $db->getLastQuery(),
+        );
+    }
+}