7 Commits
Author SHA1 Message Date
Ilija Tovilo d3f361c3b7 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add NEWS entries
  Fix GHSA-vc5h-9ppw-p5f3: phar circular symlink crash
  Fix SQL injection in ext-pgsql via E'...' backslash breakout
  libgd patch for CVE-2026-9672
2026-07-28 11:50:34 +02:00
Ilija Tovilo ab048bd83b Fix SQL injection in ext-pgsql via E'...' backslash breakout
php_pgsql_add_quotes() quotes the string with E'...', but PQescapeStringConn()
does not escape \ unless standard_conforming_strings is off.
PQescapeStringConn() is meant to be used with '', so do that instead.

Fixes GHSA-7qpv-r5mr-78m4
2026-07-28 11:11:57 +02:00
KentarouTakedaandGina Peter Banyard c15988aab3 ext/pgsql: Refactor tests (#12608)
This makes the tests independent of each other and allows them to be run in parallel.

Co-authored-by: Gina Peter Banyard <girgias@php.net>
2023-11-06 22:36:52 +00:00
Nikita Popov e378968c4f Fix EXTENSIONS section for pgsql
This should have been pgsql, not psql...
2021-06-14 14:40:38 +02:00
Nikita Popov b5a14e6c04 Port skipif.inc files to EXTENSIONS 2021-06-11 16:27:50 +02:00
Nikita Popov f8d795820e Reindent phpt files 2020-02-03 22:52:20 +01:00
Yasuo Ohgaki 56854511d8 EXPERIMENTAL flags for pg_select/pg_insert/pg_update/pg_delete are removed.
Use string escape for exotic types that allows to handle any data types. i.e. Array, JSON, JSONB, etc will work.
Add escape only query for better performance which removes meta data look up. Limitations forced by pg_convert() can be avoided with this. PGSQL_DML_ESCAPE constant is added for it.
2014-02-16 14:11:21 +09:00