From 8d66eb4926845fd1210dfa88c6fbd052fc4867bf Mon Sep 17 00:00:00 2001
From: andrew <andrew@eatigo.com>
Date: Mon, 23 Oct 2017 10:50:44 +0800
Subject: [PATCH] fixed wrong param substitution order

---
 main_test.go | 24 +++++++++++++++++++++++
 scope.go     | 54 ++++++++++++++++++++++++++++++++++++++++------------
 2 files changed, 66 insertions(+), 12 deletions(-)

diff --git a/main_test.go b/main_test.go
index 83e6f7aa..48a8bd63 100644
--- a/main_test.go
+++ b/main_test.go
@@ -631,6 +631,30 @@ func TestQueryBuilderSubselectInWhere(t *testing.T) {
 	}
 }
 
+func TestQueryBuilderRawQueryWithSubquery(t *testing.T) {
+	user := User{Name: "subquery_test_user1", Age: 10}
+	DB.Save(&user)
+	user = User{Name: "subquery_test_user2", Age: 11}
+	DB.Save(&user)
+	user = User{Name: "subquery_test_user2", Age: 12}
+	DB.Save(&user)
+
+	var count int
+	err := DB.Raw("select count(*) from (?) tmp",
+		DB.Table("users").
+			Select("name").
+			Where("age >= ? and name in (?)", 10, []string{"subquery_test_user1", "subquery_test_user2"}).
+			Group("name").
+			QueryExpr(),
+	).Count(&count).Error
+	if err != nil {
+		t.Errorf("Expected to get no errors, but got %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Row count must be 2, instead got %d", count)
+	}
+}
+
 func TestQueryBuilderSubselectInHaving(t *testing.T) {
 	user := User{Name: "query_expr_having_ruser1", Email: "root@user1.com", Age: 64}
 	DB.Save(&user)
diff --git a/scope.go b/scope.go
index 29508d8d..ba9bd37c 100644
--- a/scope.go
+++ b/scope.go
@@ -1,16 +1,16 @@
 package gorm
 
 import (
+	"bytes"
 	"database/sql"
 	"database/sql/driver"
 	"errors"
 	"fmt"
+	"reflect"
 	"regexp"
 	"strconv"
 	"strings"
 	"time"
-
-	"reflect"
 )
 
 // Scope contain current operation's information when you perform any operation on the database
@@ -555,6 +555,7 @@ func (scope *Scope) buildWhereCondition(clause map[string]interface{}) (str stri
 		return strings.Join(sqls, " AND ")
 	}
 
+	replacements := []string{}
 	args := clause["args"].([]interface{})
 	for _, arg := range args {
 		var err error
@@ -562,29 +563,43 @@ func (scope *Scope) buildWhereCondition(clause map[string]interface{}) (str stri
 		case reflect.Slice: // For where("id in (?)", []int64{1,2})
 			if scanner, ok := interface{}(arg).(driver.Valuer); ok {
 				arg, err = scanner.Value()
-				str = strings.Replace(str, "?", scope.AddToVars(arg), 1)
-			} else if bytes, ok := arg.([]byte); ok {
-				str = strings.Replace(str, "?", scope.AddToVars(bytes), 1)
+				replacements = append(replacements, scope.AddToVars(arg))
+			} else if b, ok := arg.([]byte); ok {
+				replacements = append(replacements, scope.AddToVars(b))
 			} else if values := reflect.ValueOf(arg); values.Len() > 0 {
 				var tempMarks []string
 				for i := 0; i < values.Len(); i++ {
 					tempMarks = append(tempMarks, scope.AddToVars(values.Index(i).Interface()))
 				}
-				str = strings.Replace(str, "?", strings.Join(tempMarks, ","), 1)
+				replacements = append(replacements, strings.Join(tempMarks, ","))
 			} else {
-				str = strings.Replace(str, "?", scope.AddToVars(Expr("NULL")), 1)
+				replacements = append(replacements, scope.AddToVars(Expr("NULL")))
 			}
 		default:
 			if valuer, ok := interface{}(arg).(driver.Valuer); ok {
 				arg, err = valuer.Value()
 			}
 
-			str = strings.Replace(str, "?", scope.AddToVars(arg), 1)
+			replacements = append(replacements, scope.AddToVars(arg))
+		}
+	}
+
+	buff := bytes.NewBuffer([]byte{})
+	i := 0
+	for pos := range str {
+		if str[pos] == '?' {
+			buff.WriteString(replacements[i])
+			i++
+		} else {
+			buff.WriteByte(str[pos])
 		}
 		if err != nil {
 			scope.Err(err)
 		}
 	}
+
+	str = buff.String()
+
 	return
 }
 
@@ -642,8 +657,8 @@ func (scope *Scope) buildNotCondition(clause map[string]interface{}) (str string
 			if scanner, ok := interface{}(arg).(driver.Valuer); ok {
 				arg, err = scanner.Value()
 				str = strings.Replace(str, "?", scope.AddToVars(arg), 1)
-			} else if bytes, ok := arg.([]byte); ok {
-				str = strings.Replace(str, "?", scope.AddToVars(bytes), 1)
+			} else if b, ok := arg.([]byte); ok {
+				str = strings.Replace(str, "?", scope.AddToVars(b), 1)
 			} else if values := reflect.ValueOf(arg); values.Len() > 0 {
 				var tempMarks []string
 				for i := 0; i < values.Len(); i++ {
@@ -675,6 +690,7 @@ func (scope *Scope) buildSelectQuery(clause map[string]interface{}) (str string)
 	}
 
 	args := clause["args"].([]interface{})
+	replacements := []string{}
 	for _, arg := range args {
 		switch reflect.ValueOf(arg).Kind() {
 		case reflect.Slice:
@@ -683,14 +699,28 @@ func (scope *Scope) buildSelectQuery(clause map[string]interface{}) (str string)
 			for i := 0; i < values.Len(); i++ {
 				tempMarks = append(tempMarks, scope.AddToVars(values.Index(i).Interface()))
 			}
-			str = strings.Replace(str, "?", strings.Join(tempMarks, ","), 1)
+			replacements = append(replacements, strings.Join(tempMarks, ","))
 		default:
 			if valuer, ok := interface{}(arg).(driver.Valuer); ok {
 				arg, _ = valuer.Value()
 			}
-			str = strings.Replace(str, "?", scope.AddToVars(arg), 1)
+			replacements = append(replacements, scope.AddToVars(arg))
 		}
 	}
+
+	buff := bytes.NewBuffer([]byte{})
+	i := 0
+	for pos := range str {
+		if str[pos] == '?' {
+			buff.WriteString(replacements[i])
+			i++
+		} else {
+			buff.WriteByte(str[pos])
+		}
+	}
+
+	str = buff.String()
+
 	return
 }