[GIT-PULLS] [php-src] PR #22774: ext/sqlite3: reject NUL bytes in SQLite3::escapeString()

[email protected] (iliaal) Thu, 16 Jul 2026 19:15:21 +0000
Newsgroups php.git-pulls
Message-ID <C2VVTNStdcJdzkY20gyqmspfNcnsulcMtb8Y9aQHeUM@main.internal.php.net>
Pull Request: https://github.com/php/php-src/pull/22774
Author: iliaal

`SQLite3::escapeString()` builds its result with `sqlite3_mprintf("%q")`, which stops at the first C NUL. PHP strings carry a length and may embed NULs, so `"a\0b"` came back as `"a"` and any SQL built from it silently lost everything after the NUL. Prepared binds pass an explicit length and are unaffected.

`ext/pdo_sqlite` rejected the same inputs for `PDO::quote` in 0a10f6db268 (GH-13952), landing on 8.5 and up rather than 8.4. That check consults `dbh->error_mode` and throws a PDOException, warns, or returns NULL; `escapeString()` is static, so there is no connection to consult and a ValueError is the only option available to it.

Targeting master because rejecting an input that previously returned a truncated string is a behaviour change, and 0a10f6db268 kept the same change off 8.4.