Double quotes accepted unexpectedly for literal value escape in SQLite
@SakiTakamachi is already working on this.
Since Mar 5, 2024.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
discovered in https://github.com/doctrine/dbal/pull/6325#issuecomment-1977604443
Currently PHP pdo_sqlite (and sqlite3) extensions accept SQL queries /w format that is natively not supported by SQLite degrading our testing quality as such SQL queries cannot be executed outside PHP.
PHP repro: https://3v4l.org/lfZSq
SQLite/native repro: https://dbfiddle.uk/D0hu63uV (reproducible also on https://sqlite.org/fiddle/)
Current behaviour:
" (double quote) accepted for literal value escape
Expected behaviour:
SQLite does not accept " (double quote) natively for literal value escape, I would expect the same from PHP by default, ie. fail with SQLite parse error if some query like select "-1" is executed.
PHP Version
any
Operating System
any
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.