escape single quotes in sql generator

phpcr · Jan 12, 2024 · 7b1cbce · 7b1cbce
1 parent 778bc5a
commit 7b1cbce
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,13 @@ Changelog
 2.x
 ---
 
+2.0.1
+-----
+
+* The SQL generator now escapes single quotes `'`. This avoids SQL injection risks. If you escaped
+  strings manually (by duplicating the `'`) you will need to stop doing that as otherwise the query
+  will be run with duplicated single quotes.
+
 2.0.0
 -----
 

diff --git a/src/PHPCR/Util/QOM/BaseSqlGenerator.php b/src/PHPCR/Util/QOM/BaseSqlGenerator.php
@@ -214,7 +214,7 @@ public function evalLiteral(mixed $literal): string
             return $this->evalCastLiteral($string, 'DOUBLE');
         }
 
-        return "'$literal'";
+        return sprintf("'%s'", str_replace("'", "''", $literal));
     }
 
     /**