Howto rewrite complex query to Doctrine DBAL in TYPO3? - doctrine

Question

I am struggling to migrate a complex SQL query to the Doctrine DBAL in TYPO3. My old repository query looks like this:
$enableFields = $GLOBALS['TSFE']->sys_page->enableFields('tx_test');
// calculate distance between geo coordinates
$distance = '';
if ($geoData) {
$distance = ', 3956 * 2 * ASIN( SQRT (POWER ( SIN((' . $geoData['latitude'] . ' - abs(tx_test.latitude)) * pi() / 180 / 2), 2) + COS(' . $geoData['latitude'] . ' * pi() / 180) * ' . 'COS(abs(tx_test.latitude)' .
' * pi() / 180) * POWER (SIN((' . $geoData['longitude'] .
' - tx_test.longitude)' .
' * pi() / 180 / 2), 2))) AS distance';
}
// General query
$sql = 'SELECT * ' . $distance .
' FROM tx_test ' .
' WHERE DATE_FORMAT(FROM_UNIXTIME(start), "%Y") = '.(int)$settings['flexformYear'].' AND published = 1 ' . $enableFields;
if($headline) {
$sql .= ' AND headline like '.$GLOBALS['TYPO3_DB']->quoteStr($headline).'%';
}
// ... and some more ...
$query = $this->createQuery();
$results = $query->statement($sql)->execute();
To migrate to Doctrine
Now I could easily remove the $GLOBALS['TYPO3_DB']->quoteStr() and replace the last two lines of the code above with this:
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable('tx_test');
$results = $connection->executeQuery($sql)->fetchAll();
But this returns an array of the results and not the objects with the attached sub objects, eg. a FileReference object or another attached model.
Is there another way to achieve the desired result? If not, how can I secure/sanitize the user input for $headline? And do I need to write the SQL for the joined tables myself?

Answer 1

Here is a part of some distance calculations that should fit your use case regarding the use of Doctrine and the quoting.
Using Doctrine you'll get records as array, too. See below if you want Extbase objects.
Get the TYPO3 flavor of the Doctrine DBAL QueryBuilder:
$q = GeneralUtility::makeInstance(ConnectionPool::class)
->getQueryBuilderForTable($table = 'tx_....');
$q->select(
...
'a.lat',
'a.lng'
)
->from($table /*, 'alias if you want' */);
I am not using the fluent interface much when doing calculations like that (although it is of course possible to do so by using any MySQL function with $q->selectLiteral()).
Parameters
To prevent SQL injection you should quote all possible user input with $q->quote() / $q->quoteIdentifier() or use parameters $q->createNamedParameter().
Constraints example
This is just a part of the constraints. It contains an example how to combine them based on conditions as is common in a search function.
if ((float)$searchObject->radiusKm > .5) {
$_radiusOrs = [
'IF (
' . $q->quoteIdentifier('lat') . ' = 0,
100000,
12742 * ASIN(
SQRT(
POWER(
SIN(
( ' . $q->quote((float)$searchObject->lat) . '
- ABS( ' . $q->quoteIdentifier('lat') . ' )
) * 0.0087266
),
2
)
+
COS( ' . $q->quote((float)$searchObject->lng) . ' * 0.01745329 ) * COS(
ABS( ' . $q->quoteIdentifier('lat') . ' ) * 0.01745329
) * POWER(
SIN(
( ' . $q->quote((float)$searchObject->lng) . '
- ' . $q->quoteIdentifier('lng') . '
) * 0.0087266
),
2
)
)
)
) < ' . $q->quote((float)$searchObject->radiusKm),
];
$q->andWhere(
$q->expr()->orX(...$_radiusOrs)
);
}
...
$aRes = $q->execute()->fetchAll();
(If you want to debug: You get the SQL with $q->getSQL(), $q->getParameters())
Mapping to Extbase objects
$dataMapper = $this->objectManager->get(\TYPO3\CMS\Extbase\Persistence\Generic\Mapper\DataMapper::class);
$objects = $dataMapper->map(YourExtbaseModel::class, $aRes);
I would suggest: Use Extbase objects only if you have few objects or if you have enough memory and you don't care about performance. You should mostly get away with plain arrays just as good.
The Extbase query builder allowed for a little optimization when outputting into a Fluid template: passing the \TYPO3\CMS\Extbase\Persistence\Generic\QueryResult allowed to use the f:paginate ViewHelper on it which did not have to instantiate all the objects but only those shown on current page. That possiblity is not there (yet?) when using the Doctrine QueryBuilder. So using Extbase models should rather be last resort now than being the default. It seemed to be "best practice" - that is not true any more IMHO.