mirror of
https://github.com/php/php-src.git
synced 2026-10-28 17:56:50 +08:00
Ilia Alshanetsky
7522c49630
escapeString() used sqlite3_mprintf("%q"), which stops at the first C NUL.
PHP strings are length-aware and may embed NULs, so values such as "a\0b"
were silently truncated to "a" when interpolated into SQL. Prepared binds
pass an explicit length and are unaffected.
ext/pdo_sqlite rejected the same inputs for PDO::quote in 0a10f6db26
(GH-13952), on 8.5 and up. That check consults the connection's error mode;
escapeString() is static and has no connection, so it throws instead.
Closes GH-22774