Download the PHP package initorm/query-builder without Composer

InitORM QueryBuilder

A lightweight, dialect-aware SQL query builder for PHP. It turns fluent calls into a SQL string plus a separate parameter bag suitable for direct execution with PDO — without ever concatenating user values into SQL.

InitORM QueryBuilder is the lowest layer of the InitORM package family; it has no runtime dependencies beyond the pdo extension and is designed to be used either standalone or as part of the initorm/database and initorm/orm stack.

Why this library

• Safe by default — every value goes through a collision-safe parameter bag. Raw fragments are opt-in via RawQuery.
• Dialect aware — identifier escaping is delegated to pluggable drivers for MySQL/MariaDB, PostgreSQL, SQLite, plus a no-op generic driver.
• Tiny and predictable — single namespace, no service container, no reflection, no annotations; the whole thing is around 1 600 lines of code.
• Battle-tested clause DSL — comparison operators, BETWEEN, IN, LIKE family (like / startLike / endLike), NULL checks, REGEXP, SOUNDEX, FIND_IN_SET, sub-queries, parenthesized groups, closure-based JOIN ON expressions.

Requirements

• PHP ≥ 8.1
• ext-pdo (only needed by the consumer at execution time; the builder itself does not require an open connection)

Installation

Quick start

INSERT

Sub-query in WHERE IN

Closure-based JOIN ON

Batch UPDATE (CASE/WHEN)

Supported drivers

A custom dialect can be added by extending Drivers\AbstractDriver and setting the NAME and ESCAPE_CHAR class constants.

Documentation

Full developer documentation with runnable examples lives in docs/en/index.md for the table of contents.

Security

InitORM QueryBuilder is built around the rule "user input is a value, never an identifier or a SQL fragment". Defenses shipped in 2.0.0:

• Identifier hardening — escapeIdentifier() rejects ; and -- so query-breakout characters in a column or table name cannot survive the escape pass (relevant especially on PostgreSQL, where PDO allows multi-statement queries by default).
• LIKE wildcard auto-escape — %, _, and \ inside user-supplied LIKE values are escaped by default. Opt out with $qb->raw(...) when raw wildcards are intentional.
• Strict placeholder regex — placeholder names are now tightly bound to ^:\w+$.
• FIND_IN_SET parameter fix (B28) — a pre-2.0.0 inversion bug inlined raw user strings as SQL; fixed.

The full threat model, residual application-level concerns (ORDER BY whitelisting, value-shaped function detection), and a complete regression suite live in docs/en/security.md and tests/SecurityTest.php.

Report vulnerabilities through the organization-wide security policy.

Tests, lint, static analysis

The repository ships with GitHub Actions workflows under .github/workflows/ that run the same checks on every push and pull request, across the PHP 8.1 → 8.4 matrix.

Current numbers: 293 tests / 391 assertions / 96.46 % line coverage.

Contributing

The contribution workflow, code style, and pull-request template are shared across the InitORM organization. See InitORM/.github → CONTRIBUTING and the PR template. A short summary:

1. Branch from master.
2. Stick to PSR-12; run composer qa before opening a PR.
3. Add tests for new behavior — the test suite is the contract.
4. Reference issues with Fixes #123 / Refs #123.

Security issues should follow the disclosure process in InitORM/.github → SECURITY.

Versioning

This package follows Semantic Versioning. The behavioral and structural changes between 1.x and 2.x are listed in CHANGELOG.md.

License

MIT — see LICENSE.

Credits

Authored and maintained by Muhammet ŞAFAK <[email protected]>. Issues and contributions are welcome on GitHub.