From c21bf32aeda5e9744855c1b1c20789d4ac33c928 Mon Sep 17 00:00:00 2001
From: Ingolf Steinhardt <info@e-spin.de>
Date: Tue, 1 Sep 2026 15:35:16 +0200
Subject: [PATCH] Quote the column name in MetaModel::saveSimpleColumn()'s
 UPDATE statement

Same pattern as BaseSimple::setDataFor(): "SET <column> = ..." built
with the bare, unquoted column name - breaks for any column whose
name happens to be a SQL reserved word. Currently only called with
fixed literals (vargroup, pid, sorting, tstamp), none of which are
reserved words, but the method is protected and can be called with
arbitrary column names by subclasses. Quoted via
Connection::quoteIdentifier().
---
 src/MetaModel.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/MetaModel.php b/src/MetaModel.php
index 3f0857eff..70cbb995a 100644
--- a/src/MetaModel.php
+++ b/src/MetaModel.php
@@ -1174,17 +1174,20 @@ public function getAttributeOptions($strAttribute, $objFilter = null)
      *
      * @return void
      */
+    /** @psalm-suppress DeprecatedMethod - Connection::quoteIdentifier() is marked internal/deprecated in DBAL 4
+     *                                    with no replacement that also works on DBAL 3. */
     protected function saveSimpleColumn($strColumn, $arrIds, $varData)
     {
         if (\is_array($varData)) {
             $varData = \serialize($varData);
         }
 
-        $builder = $this->getConnection()->createQueryBuilder();
+        $connection = $this->getConnection();
+        $builder    = $connection->createQueryBuilder();
 
         $builder
             ->update($this->getTableName())
-            ->set($strColumn, \is_array($varData) ? \serialize($varData) : $varData)
+            ->set($connection->quoteIdentifier($strColumn), \is_array($varData) ? \serialize($varData) : $varData)
             ->where($builder->expr()->in('id', ':ids'))
             ->setParameter('ids', $arrIds, ArrayParameterType::STRING)
             ->executeQuery();