[techmahedy]

Pull Request Checklist

Q	A
Branch?	4.x
Bug fix?	yes
New feature?	no
Deprecations?	no
Issues	-
License	MIT

This PR solves two problems

1. Fix SQL injection via unvalidated table, view and column identifiers
2. Fix PostgreSQL temporal lookups reading times in the session timezone

Security

Significantly improved

Summary

Identifiers passed to Database::view() and Grammar::getTableColumnsSql() were interpolated directly into SQL. Prepared statements protect values, not identifiers, so user-controlled input reaching these methods allowed SQL injection.

Changes

• Grammar::getTableColumnsSql(): validate the table name with assertValidIdentifier() and quote it in the SQLite (PRAGMA table_info) and MySQL (DESCRIBE) queries. The PostgreSQL query validates before interpolating its string literal.
• Database::view(): validate the view name (name or schema.name) and quote it per driver.
• Database::view(): validate the column names from $where (plain identifiers only) and quote them in the condition. Values remain bound parameters.
• Invalid identifiers throw InvalidArgumentException.

Checklist

• Tests have been added or updated
• Documentation has been updated if necessary
• Code follows the project coding standards
• All tests pass locally