[abdulmajidcse]

Pull Request Checklist

Q	A
Branch?	4.x
Bug fix?	yes
New feature?	no
Deprecations?	no
Issues	-
License	MIT

Description

where(), orWhere(), if(), embed() and embedCount() used is_callable() to tell whether an argument is a callback. is_callable() also returns true for strings that name a PHP function, so ordinary column names and values were called as functions:

• where('date', $x) called date($builder) and threw a TypeError. Columns named time, key, max, min, file, end and range failed the same way, in both Entity\Builder and Query\Builder.
• ->if($request->input('filter'), …) with filter=phpinfo ran phpinfo() and printed the server configuration.
• embed(['link', …]) with a relation named after a function called that function as the relation's constraint.

The fix adds a Grammar::isCallback() helper (!is_string($value) && is_callable($value)) and uses it at these sites. Closures, invokable objects and [$obj, 'method'] callables behave as before; only bare strings are no longer called.

Checklist

• Tests have been added or updated (tests/Builder/StringArgumentNotCallableTest.php: 20 tests that fail on the old code and pass on the new)
• Documentation has been updated if necessary (not needed)
• Code follows the project coding standards
• All tests pass locally (full suite and PHPStan)

[NazmusShakib]

Thanks for this PR! We really appreciate your contribution. Our team will review it shortly.

[techmahedy]

Thanks @abdulmajidcse, great catch and a clear write-up. Treating strings as column names/values instead of callbacks is the right fix, and the tests for where/orWhere/if are solid. Merging this now.