note 98079 added to sqlite3.escapestring

I seems that the function only escapes single quote ' and left double quote " untouched.

<?php

$database_filename = "database.db";
$dbhandle = new SQLite3($database_filename, $mode=0666, $sqliteerror);
$escape_result = $dbhandle->escapeString("testing's is \"fun\".");
print "$escape_result\n";

?>

The result would be:

  testing''s is "fun".

So, please use single quote to quote text in sqlite query.

<?php

// this should be OK
$sql = sprintf("INSERT INTO table1 (somestr1, somestr2) VALUES ('%s', '%s')", 
  $dbhandle->($somestr1), $dbhandle->($somestr1));
$dbhandle->query($sql);

// this would be vulnerable to injection
$sql = sprintf('INSERT INTO table1 (somestr1, somestr2) VALUES ("%s", "%s")', 
  $dbhandle->($somestr1), $dbhandle->($somestr1));
$dbhandle->query($sql);

?>
----
Server IP: 69.147.83.197
Probable Submitter: 59.148.91.119
----
Manual Page -- http://www.php.net/manual/en/sqlite3.escapestring.php
Edit        -- https://master.php.net/note/edit/98079
Del: integrated  -- https://master.php.net/note/delete/98079/integrated
Del: useless     -- https://master.php.net/note/delete/98079/useless
Del: bad code    -- https://master.php.net/note/delete/98079/bad+code
Del: spam        -- https://master.php.net/note/delete/98079/spam
Del: non-english -- https://master.php.net/note/delete/98079/non-english
Del: in docs     -- https://master.php.net/note/delete/98079/in+docs
Del: other reasons-- https://master.php.net/note/delete/98079
Reject      -- https://master.php.net/note/reject/98079
Search      -- https://master.php.net/manage/user-notes.php