From f34e91deb2690affea650494abdc8e3592fc7ad0 Mon Sep 17 00:00:00 2001
From: thinkphp <thinkphp@qq.com>
Date: Sat, 14 Apr 2018 12:43:52 +0800
Subject: [PATCH] =?UTF-8?q?exp=E8=A1=A8=E8=BE=BE=E5=BC=8F=E6=9F=A5?=
 =?UTF-8?q?=E8=AF=A2=E6=94=B9=E8=BF=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 library/think/db/Builder.php |  6 +++++-
 library/think/db/Query.php   | 19 +++++++++++++------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/library/think/db/Builder.php b/library/think/db/Builder.php
index ec30ccbb..6456b4bd 100644
--- a/library/think/db/Builder.php
+++ b/library/think/db/Builder.php
@@ -388,7 +388,11 @@ abstract class Builder
             }
         } elseif ('EXP' == $exp) {
             // 表达式查询
-            $whereStr .= '( ' . $key . ' ' . ($value instanceof Expression ? $value->getValue() : $value) . ' )';
+            if ($value instanceof Expression) {
+                $whereStr .= '( ' . $key . ' ' . $value->getValue() . ' )';
+            } else {
+                throw new Exception('where express error:' . $exp);
+            }
         } elseif (in_array($exp, ['NOT NULL', 'NULL'])) {
             // NULL 查询
             $whereStr .= $key . ' IS ' . $exp;
diff --git a/library/think/db/Query.php b/library/think/db/Query.php
index 205f1f33..eb86d43b 100644
--- a/library/think/db/Query.php
+++ b/library/think/db/Query.php
@@ -1239,7 +1239,7 @@ class Query
             // 记录一个字段多次查询条件
             $this->options['multi'][$logic][$field][] = $where[$field];
         } elseif (is_string($field) && preg_match('/[,=\>\<\'\"\(\s]/', $field)) {
-            $where[] = ['exp', $field];
+            $where[] = ['exp', $this->raw($field)];
             if (is_array($op)) {
                 // 参数绑定
                 $this->bind($op);
@@ -1260,21 +1260,28 @@ class Query
             $where[$field] = $param;
         } elseif (in_array(strtolower($op), ['null', 'notnull', 'not null'])) {
             // null查询
-            $where[$field]                            = [$op, ''];
+            $where[$field] = [$op, ''];
+
             $this->options['multi'][$logic][$field][] = $where[$field];
         } elseif (is_null($condition)) {
             // 字段相等查询
-            $where[$field]                            = ['eq', $op];
+            $where[$field] = ['eq', $op];
+
             $this->options['multi'][$logic][$field][] = $where[$field];
         } else {
-            $where[$field] = [$op, $condition, isset($param[2]) ? $param[2] : null];
-            if ('exp' == strtolower($op) && isset($param[2]) && is_array($param[2])) {
+            if ('exp' == strtolower($op)) {
+                $where[$field] = ['exp', $this->raw($condition)];
                 // 参数绑定
-                $this->bind($param[2]);
+                if (isset($param[2]) && is_array($param[2])) {
+                    $this->bind($param[2]);
+                }
+            } else {
+                $where[$field] = [$op, $condition];
             }
             // 记录一个字段多次查询条件
             $this->options['multi'][$logic][$field][] = $where[$field];
         }
+
         if (!empty($where)) {
             if (!isset($this->options['where'][$logic])) {
                 $this->options['where'][$logic] = [];