Quote predicate names as identifiers where fragment quoting renders broken SQL - #244

Merge order: builds on #241's shared IdentifierQuoter, so merge #241 first. Until then this diff also shows #241's changes.

Problem

A predicate's left-hand name is rendered through AbstractPlatform::quoteIdentifierInFragment(). It splits the name on every character outside the platform's word class and quotes each piece, except spaces, dots, * and AS. A name that holds any other delimiter therefore renders as a different, invalid identifier:

This affects these predicates in WHERE and HAVING on Select, and in WHERE on Update and Delete:

• equalTo, notEqualTo
• lessThan, lessThanOrEqualTo, greaterThan, greaterThanOrEqualTo
• like, notLike
• in, notIn
• between, notBetween
• isNull, isNotNull
• where-array keys

Cause

AbstractSql::processExpression() renders every Argument\Identifier through quoteIdentifierInFragment(), and so does processIdentifiersArgument() for Argument\Identifiers. Fragment quoting is meant for loose SQL, not for a single name. Select columns (#241), ORDER BY names (#243) and Update SET columns (#238) have the same cause.

Fix

Both now quote with IdentifierQuoter::quote(), the shared rule added in #241:

• Plain and dotted names take a fast path and render exactly as before.
• Names that fragment quoting renders as written, such as price*qty, a * b and x AS y, keep fragment quoting.
• A name that fragment quoting would split is quoted whole per qualifier part.
• Expression syntax that no identifier quoting renders as written throws InvalidArgumentException. Examples are a - b, COUNT(id), and a+b on a platform where - is a word character. An empty name or qualifier part throws too.

The check asks the platform itself, so phpdb-mysql, whose fragment pattern treats - as a word character, keeps `a-b` * `c` unchanged.

The same rule also applies to the other Identifier arguments rendered through processExpression(): identifier-typed Expression parameters and DDL names. DDL names should always be quoted whole; that is listed as a follow-up in #241.

What stays the same

• Plain names, dotted names, t.*, price*qty, a * b, t.a * t.b, x as y / x AS y and a,b render exactly as before.
• Expression, Literal and string predicates are untouched, and so are values and string join ON clauses, which call quoteIdentifierInFragment() directly with extra safe words.
• No public or protected API changes. The new exceptions are named constructors on Sql\Exception\InvalidArgumentException.

Behaviour change

Output changes only for names that rendered invalid SQL before. Those that now throw (expression syntax and empty names) used to render broken SQL that only failed at the database. That includes the empty name, which rendered as nothing, e.g. = '1'.

Tests

test/unit/Sql/PredicateIdentifierNameTest.php (#[Group('unit')]) uses data providers to cover:

• broken forms now quoted as one identifier: hyphen, space, quote character, non-ASCII, tab, dotted hyphen, dotted space and hyphenated qualified star. Each runs across every predicate type above, plus where-array keys (with a value and with null), HAVING, Update WHERE and Delete WHERE;
• valid forms proven byte-identical across the same paths;
• an Argument::identifiers() list;
• the shared TrustingHyphenWordPlatform;
• rejected names: COUNT(id), a - b, x-y * 2, a+b on the hyphen platform, '' and a..b;
• Expression, Literal and string predicates left unchanged.

Checks:

• The full suite passes.
• mago format --check, mago lint and mago analyze exit 0 on PHP 8.3, 8.4 and 8.5, and so does mago guard.