ext/sqlite3: reject NUL bytes in SQLite3::escapeString()#22774
Open
iliaal wants to merge 1 commit into
Open
Conversation
escapeString() used sqlite3_mprintf("%q"), which stops at the first C NUL.
PHP strings are length-aware and may embed NULs, so values such as "a\0b"
were silently truncated to "a" when interpolated into SQL. Prepared binds
pass an explicit length and are unaffected.
ext/pdo_sqlite rejected the same inputs for PDO::quote in 0a10f6d
(phpGH-13952), on 8.5 and up. That check consults the connection's error mode;
escapeString() is static and has no connection, so it throws instead.
Closes phpGH-22774
iliaal
force-pushed
the
fix/sqlite3-escapestring-nul
branch
from
c6835ba to
70a5508
Compare
ndossche
requested changes
Jul 16, 2026
ndossche
left a comment
ndossche
left a comment
Member
There was a problem hiding this comment.
You should use the "P" zend_parse_parameters classifier instead of "S", it will do the check for you.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SQLite3::escapeString()builds its result withsqlite3_mprintf("%q"), which stops at the first C NUL. PHP strings carry a length and may embed NULs, so"a\0b"came back as"a"and any SQL built from it silently lost everything after the NUL. Prepared binds pass an explicit length and are unaffected.ext/pdo_sqliterejected the same inputs forPDO::quotein 0a10f6d (GH-13952), landing on 8.5 and up rather than 8.4. That check consultsdbh->error_modeand throws a PDOException, warns, or returns NULL;escapeString()is static, so there is no connection to consult and a ValueError is the only option available to it.Targeting master because rejecting an input that previously returned a truncated string is a behaviour change, and 0a10f6d kept the same change off 8.4.