{"record":{"id":"c9f2d5a25bd6ea35","repo":"phalcon/cphalcon","slug":"invalid-where-clause-conditions","errorCode":null,"errorMessage":"Invalid WHERE clause conditions","messagePattern":"Invalid WHERE clause conditions","errorType":"exception","errorClass":"Phalcon\\Db\\Exceptions\\InvalidWhereConditions","httpStatus":null,"severity":"error","filePath":"phalcon/Db/Adapter/AbstractAdapter.zep","lineNumber":1455,"sourceCode":"\n        let escapedTable = this->escapeIdentifier(tableName),\n            setClause    = join(\", \", placeholders);\n\n        if whereCondition !== null {\n            let updateSql = \"UPDATE \" . escapedTable . \" SET \" . setClause . \" WHERE \";\n\n            /**\n             * String conditions are simply appended to the SQL\n             */\n            if typeof whereCondition == \"string\" {\n                let updateSql .= whereCondition;\n            } else {\n\n                /**\n                 * Array conditions may have bound params and bound types\n                 */\n                if unlikely typeof whereCondition != \"array\" {\n                    throw new InvalidWhereConditions();\n                }\n\n                /**\n                 * If an index 'conditions' is present it contains string where\n                 * conditions that are appended to the UPDATE SQL\n                 */\n                if fetch conditions, whereCondition[\"conditions\"] {\n                    let updateSql .= conditions;\n                }\n\n                /**\n                 * Bound parameters are arbitrary values that are passed\n                 * separately\n                 */\n                if fetch whereBind, whereCondition[\"bind\"] {\n                    merge_append(updateValues, whereBind);\n                }\n","sourceCodeStart":1437,"sourceCodeEnd":1473,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Db/Adapter/AbstractAdapter.zep#L1437-L1473","documentation":"In update(), $whereCondition must be a string (appended raw to the UPDATE SQL, unescaped) or an array (with optional 'conditions', 'bind', 'bindTypes' keys). Any other type throws InvalidWhereConditions. Note that Zephir's typeof check rejects objects with __toString() too — a Stringable object is not a 'string' at this level, so it must be cast first.","triggerScenarios":"$db->update('users', $fields, $values, 123); passing an object such as a PDOStatement, an expression builder result, or a value object with __toString(); passing null is fine (default) but false/float/int throw.","commonSituations":"Passing a where clause built by another library (query builder object) directly; Stringable enums/value objects used as conditions; truthy scalar conditions coming from untyped request data.","solutions":["Pass the condition as a string: \"id = 123\" (remember: not escaped — bind when values are dynamic)","Or use the array form for safe binding: ['conditions' => 'id = ?', 'bind' => [$id], 'bindTypes' => [Column::BIND_PARAM_INT]]","Cast Stringable objects: $where = (string) $exprObject before passing"],"exampleFix":"// before\n$db->update('users', $fields, $values, $someConditionObject);\n\n// after\n$db->update('users', $fields, $values, [\n    'conditions' => 'id = ?',\n    'bind'       => [$id],\n    'bindTypes'  => [Column::BIND_PARAM_INT],\n]);","handlingStrategy":"validation","validationCode":"if ($whereCondition !== null && !is_string($whereCondition) && !is_array($whereCondition)) {\n    $whereCondition = is_object($whereCondition) && method_exists($whereCondition, '__toString')\n        ? (string) $whereCondition\n        : throw new InvalidArgumentException('whereCondition must be string or array');\n}\n$connection->update($table, $fields, $values, $whereCondition);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the array form ['conditions' => ..., 'bind' => ..., 'bindTypes' => ...] whenever the condition includes user data — it binds safely","Cast Stringable objects to string before passing; the internal typeof check does not honor __toString()","Static-analyze call sites of update() for the 4th argument type"],"tags":["php","phalcon","db","update","where-clause","type-error"],"backgroundTag":"invalid-where-clause-type","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}