php / php/php-src

Double quotes accepted unexpectedly for literal value escape in SQLite

Open
#13,597 10 comments 0 reactions 1 assignee View on GitHub

@SakiTakamachi is already working on this.

Since Mar 5, 2024.

Extension: pdo_sqlite Extension: sqlite3 Feature
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

discovered in https://github.com/doctrine/dbal/pull/6325#issuecomment-1977604443

Currently PHP pdo_sqlite (and sqlite3) extensions accept SQL queries /w format that is natively not supported by SQLite degrading our testing quality as such SQL queries cannot be executed outside PHP.

PHP repro: https://3v4l.org/lfZSq

SQLite/native repro: https://dbfiddle.uk/D0hu63uV (reproducible also on https://sqlite.org/fiddle/)

Current behaviour:

" (double quote) accepted for literal value escape

Expected behaviour:

SQLite does not accept " (double quote) natively for literal value escape, I would expect the same from PHP by default, ie. fail with SQLite parse error if some query like select "-1" is executed.

PHP Version

any

Operating System

any

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.