fix(adapter): use JSON_CONTAINS / json_each for array CONTAINS

The LIKE `%json_encode%` pattern produces false positives on array
columns: searching `2` in a TINYINT array matches `[12, 200]`,
searching `"apple"` matches `["pineapple"]`, etc. Route onArray()
CONTAINS / CONTAINS_ANY / NOT_CONTAINS through exact-element
operators instead:

- MariaDB: JSON_OVERLAPS when supported, JSON_CONTAINS per element
  OR'd together as fallback. The LIKE branch no longer special-cases
  arrays.
- SQLite: EXISTS (SELECT 1 FROM json_each(col) WHERE value IN (...))
  via a new buildArrayContainsCondition routed from getSQLCondition
  before the LIKE handler.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: abnegate

src/Database/Adapter/MariaDB.php

@@ -1627,12 +1627,30 @@ protected function getSQLCondition(Query $query, array &$binds, ?string $forColl
             case Query::TYPE_CONTAINS:
             case Query::TYPE_CONTAINS_ANY:
             case Query::TYPE_NOT_CONTAINS:
-                if ($this->getSupportForJSONOverlaps() && $query->onArray()) {
-                    $binds[":{$placeholder}_0"] = json_encode($query->getValues());
+                if ($query->onArray()) {
                     $isNot = $query->getMethod() === Query::TYPE_NOT_CONTAINS;
-                    return $isNot
-                        ? "NOT (JSON_OVERLAPS({$alias}.{$attribute}, :{$placeholder}_0))"
-                        : "JSON_OVERLAPS({$alias}.{$attribute}, :{$placeholder}_0)";
+
+                    if ($this->getSupportForJSONOverlaps()) {
+                        $binds[":{$placeholder}_0"] = json_encode($query->getValues());
+                        return $isNot
+                            ? "NOT (JSON_OVERLAPS({$alias}.{$attribute}, :{$placeholder}_0))"
+                            : "JSON_OVERLAPS({$alias}.{$attribute}, :{$placeholder}_0)";
+                    }
+
+                    // JSON_CONTAINS per element OR'd together — exact
+                    // element match without LIKE's substring false positives
+                    // (`%2%` matching `[12, 200]`, `%"apple"%` matching
+                    // `["pineapple"]`).
+                    $conditions = [];
+                    foreach ($query->getValues() as $key => $value) {
+                        $binds[":{$placeholder}_{$key}"] = json_encode($value);
+                        $conditions[] = "JSON_CONTAINS({$alias}.{$attribute}, :{$placeholder}_{$key})";
+                    }
+                    if (empty($conditions)) {
+                        return '';
+                    }
+                    $expression = '(' . implode(' OR ', $conditions) . ')';
+                    return $isNot ? "NOT {$expression}" : $expression;
                 }
                 // no break
             default:
@@ -1649,8 +1667,7 @@ protected function getSQLCondition(Query $query, array &$binds, ?string $forColl
                         Query::TYPE_NOT_STARTS_WITH => $this->escapeWildcards($value) . '%',
                         Query::TYPE_ENDS_WITH => '%' . $this->escapeWildcards($value),
                         Query::TYPE_NOT_ENDS_WITH => '%' . $this->escapeWildcards($value),
-                        Query::TYPE_CONTAINS, Query::TYPE_CONTAINS_ANY => ($query->onArray()) ? '%' . $this->escapeWildcards((string) (\json_encode($value) ?: '')) . '%' : '%' . $this->escapeWildcards($value) . '%',
-                        Query::TYPE_NOT_CONTAINS => ($query->onArray()) ? '%' . $this->escapeWildcards((string) (\json_encode($value) ?: '')) . '%' : '%' . $this->escapeWildcards($value) . '%',
+                        Query::TYPE_CONTAINS, Query::TYPE_CONTAINS_ANY, Query::TYPE_NOT_CONTAINS => '%' . $this->escapeWildcards($value) . '%',
                         default => $value
                     };
 

src/Database/Adapter/SQLite.php

@@ -3162,6 +3162,17 @@ protected function getSQLCondition(Query $query, array &$binds, ?string $forColl
         ];
 
         if (\in_array($method, $likeMethods, true)) {
+            // Array CONTAINS via json_each — exact element match without
+            // LIKE substring false positives (`%2%` matching `[12, 200]`).
+            $arrayContainsMethods = [
+                Query::TYPE_CONTAINS,
+                Query::TYPE_CONTAINS_ANY,
+                Query::TYPE_NOT_CONTAINS,
+            ];
+            if ($query->onArray() && \in_array($method, $arrayContainsMethods, true)) {
+                return $this->buildArrayContainsCondition($query, $binds);
+            }
+
             return $this->getLikeCondition($query, $binds);
         }
 
@@ -3218,6 +3229,41 @@ private function buildSearchLikeFallback(
         return $method === Query::TYPE_SEARCH ? $sql : "NOT ({$sql})";
     }
 
+    /**
+     * Array CONTAINS / CONTAINS_ANY / NOT_CONTAINS via json_each. Exact
+     * element match — avoids the LIKE substring false positives where
+     * `%2%` matches `[12, 200]` and `%"apple"%` matches `["pineapple"]`.
+     *
+     * @param array<string,mixed> $binds
+     */
+    private function buildArrayContainsCondition(Query $query, array &$binds): string
+    {
+        $method = $query->getMethod();
+        $query->setAttribute($this->getInternalKeyForAttribute($query->getAttribute()));
+
+        $attribute = $this->quote($this->filter($query->getAttribute()));
+        $alias = $this->quote(Query::DEFAULT_ALIAS);
+        $placeholder = ID::unique();
+
+        $values = $query->getValues();
+        if (empty($values)) {
+            return '';
+        }
+
+        $params = [];
+        foreach ($values as $key => $value) {
+            $param = ":{$placeholder}_{$key}";
+            $binds[$param] = $value;
+            $params[] = $param;
+        }
+
+        $expression = "EXISTS (SELECT 1 FROM json_each({$alias}.{$attribute}) WHERE value IN ("
+            . \implode(', ', $params)
+            . '))';
+
+        return $method === Query::TYPE_NOT_CONTAINS ? "NOT {$expression}" : $expression;
+    }
+
     /**
      * FTS5 vtable on `$collection` that covers `$attribute`. Multi-column
      * indexes can't be addressed from a single attribute alone — the
@@ -3276,16 +3322,12 @@ protected function getLikeCondition(Query $query, array &$binds): string
             Query::TYPE_NOT_CONTAINS,
         ], true);
 
-        $onArray = $query->onArray();
-
         $conditions = [];
         foreach ($query->getValues() as $key => $value) {
             $bound = match ($method) {
                 Query::TYPE_STARTS_WITH, Query::TYPE_NOT_STARTS_WITH => $this->escapeWildcards($value) . '%',
                 Query::TYPE_ENDS_WITH, Query::TYPE_NOT_ENDS_WITH => '%' . $this->escapeWildcards($value),
-                Query::TYPE_CONTAINS, Query::TYPE_CONTAINS_ANY, Query::TYPE_NOT_CONTAINS => $onArray
-                    ? '%' . $this->escapeWildcards((string) (\json_encode($value) ?: '')) . '%'
-                    : '%' . $this->escapeWildcards($value) . '%',
+                Query::TYPE_CONTAINS, Query::TYPE_CONTAINS_ANY, Query::TYPE_NOT_CONTAINS => '%' . $this->escapeWildcards($value) . '%',
                 default => $value,
             };