Skip to content
This repository was archived by the owner on Jun 2, 2025. It is now read-only.

Commit 931c82b

Browse files
JanJakesJanJakes
committed
Improve escaping clarity and docs
1 parent 240bbf8 commit 931c82b

File tree

3 files changed

+38
-34
lines changed

3 files changed

+38
-34
lines changed

‎wp-includes/mysql/class-wp-mysql-token.php

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -62,18 +62,19 @@ public function get_value(): string {
6262
*
6363
* See: https://dev.mysql.com/doc/refman/8.4/en/string-literals.html
6464
*/
65+
$backslash = chr( 92 );
6566
$replacements = array(
6667
/*
6768
* MySQL special character escape sequences.
6869
*/
69-
'\0' => chr( 0 ), // An ASCII NULL (X'00') character.
70-
"\'" => "'", // A single quote (') character.
71-
'\"' => '"', // A double quote (") character.
72-
'\b' => chr( 8 ), // A backspace character.
73-
'\n' => "\n", // A newline (linefeed) character.
74-
'\r' => "\r", // A carriage return character.
75-
'\t' => "\t", // A tab character.
76-
'\Z' => chr( 26 ), // An ASCII 26 (Control+Z) character.
70+
( $backslash . '0' ) => chr( 0 ), // An ASCII NULL character (\0).
71+
( $backslash . "'" ) => chr( 39 ), // A single quote character (').
72+
( $backslash . '"' ) => chr( 34 ), // A double quote character (").
73+
( $backslash . 'b' ) => chr( 8 ), // A backspace character.
74+
( $backslash . 'n' ) => chr( 10 ), // A newline (linefeed) character (\n).
75+
( $backslash . 'r' ) => chr( 13 ), // A carriage return character (\r).
76+
( $backslash . 't' ) => chr( 9 ), // A tab character (\t).
77+
( $backslash . 'Z' ) => chr( 26 ), // An ASCII 26 (Control+Z) character.
7778

7879
/*
7980
* Normalize escaping of "%" and "_" characters.
@@ -92,8 +93,8 @@ public function get_value(): string {
9293
* > of pattern-matching contexts, they evaluate to the strings \% and
9394
* > \_, not to % and _.
9495
*/
95-
'\%' => '\\\\%',
96-
'\_' => '\\\\_',
96+
( $backslash . '%' ) => $backslash . $backslash . '%',
97+
( $backslash . '_' ) => $backslash . $backslash . '_',
9798

9899
/*
99100
* Preserve a double backslash as-is, so that the trailing backslash
@@ -102,13 +103,13 @@ public function get_value(): string {
102103
* Resolving "\\" to "\" will be handled in the next step, where all
103104
* other backslash-prefixed characters resolve to their literal values.
104105
*/
105-
'\\\\' => '\\\\',
106+
( $backslash . $backslash )
107+
=> $backslash . $backslash,
106108

107109
/*
108110
* The bounding quotes can also be escaped by being doubled.
109111
*/
110-
$quote . $quote
111-
=> $quote,
112+
( $quote . $quote ) => $quote,
112113
);
113114

114115
/*
@@ -127,7 +128,8 @@ public function get_value(): string {
127128
* A backslash with any other character represents the character itself.
128129
* That is, \x evaluates to x, \\ evaluates to \, and \🙂 evaluates to 🙂.
129130
*/
130-
$value = preg_replace( '/\\\\(.)/u', '$1', $value );
131+
$preg_quoted_backslash = preg_quote( $backslash );
132+
$value = preg_replace( "/$preg_quoted_backslash(.)/u", '$1', $value );
131133
}
132134
return $value;
133135
}

‎wp-includes/sqlite-ast/class-wp-sqlite-driver.php

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3560,7 +3560,7 @@ private function quote_mysql_identifier( string $unquoted_identifier ): string {
35603560
}
35613561

35623562
/**
3563-
* Format a MySQL string literal for output in a CREATE TABLE statement.
3563+
* Format a MySQL UTF-8 string literal for output in a CREATE TABLE statement.
35643564
*
35653565
* We expect UTF-8 strings coming from SQLite. The only characters that must
35663566
* be escaped in a single-quoted string for a UTF-8 MySQL dump are ' and \.
@@ -3580,10 +3580,10 @@ private function quote_mysql_identifier( string $unquoted_identifier ): string {
35803580
* TODO: We may consider stripping invalid UTF-8 characters, but that's likely
35813581
* to be a bigger project, as these can appear also in other contexts.
35823582
*
3583-
* @param string $literal The string literal to escape.
3584-
* @return string The escaped string literal.
3583+
* @param string $utf8_literal The UTF-8 string literal to escape.
3584+
* @return string The escaped string literal.
35853585
*/
3586-
private function quote_mysql_utf8_string_literal( string $literal ): string {
3586+
private function quote_mysql_utf8_string_literal( string $utf8_literal ): string {
35873587
/*
35883588
* We can't use "addcslashes()" here, because it has an unusual handling
35893589
* of the ASCII NULL character, escaping it to "\000" instead of "\0".
@@ -3595,14 +3595,15 @@ private function quote_mysql_utf8_string_literal( string $literal ): string {
35953595
* - str_replace( [ 'a', 'b' ], [ 'b', 'c' ], 'ab' ); // 'cc' (bad)
35963596
* - strtr( 'ab', [ 'a' => 'b', 'b' => 'c' ] ); // 'bc' (good)
35973597
*/
3598+
$backslash = chr( 92 );
35983599
$replacements = array(
3599-
"'" => "''",
3600-
'\\' => '\\\\',
3601-
"\0" => '\0',
3602-
"\n" => '\n',
3603-
"\r" => '\r',
3600+
"'" => "''", // A single quote character (').
3601+
$backslash => $backslash . $backslash, // A backslash character (\).
3602+
chr( 0 ) => $backslash . '0', // An ASCII NULL character (\0).
3603+
chr( 10 ) => $backslash . 'n', // A newline (linefeed) character (\n).
3604+
chr( 13 ) => $backslash . 'r', // A carriage return character (\r).
36043605
);
3605-
return "'" . strtr( $literal, $replacements ) . "'";
3606+
return "'" . strtr( $utf8_literal, $replacements ) . "'";
36063607
}
36073608

36083609
/**

‎wp-includes/sqlite-ast/class-wp-sqlite-information-schema-reconstructor.php

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -664,25 +664,26 @@ private function get_mysql_column_type( string $column_type ): string {
664664
}
665665

666666
/**
667-
* Format a MySQL string literal for output in a CREATE TABLE statement.
667+
* Format a MySQL UTF-8 string literal for output in a CREATE TABLE statement.
668668
*
669669
* See WP_SQLite_Driver::quote_mysql_utf8_string_literal().
670670
*
671671
* TODO: This is a copy of WP_SQLite_Driver::quote_mysql_utf8_string_literal().
672672
* We may consider extracing it to reusable MySQL helpers.
673673
*
674-
* @param string $literal The string literal to escape.
675-
* @return string The escaped string literal.
674+
* @param string $utf8_literal The UTF-8 string literal to escape.
675+
* @return string The escaped string literal.
676676
*/
677-
private function quote_mysql_utf8_string_literal( string $literal ): string {
677+
private function quote_mysql_utf8_string_literal( string $utf8_literal ): string {
678+
$backslash = chr( 92 );
678679
$replacements = array(
679-
"'" => "''",
680-
'\\' => '\\\\',
681-
"\0" => '\0',
682-
"\n" => '\n',
683-
"\r" => '\r',
680+
"'" => "''", // A single quote character (').
681+
$backslash => $backslash . $backslash, // A backslash character (\).
682+
chr( 0 ) => $backslash . '0', // An ASCII NULL character (\0).
683+
chr( 10 ) => $backslash . 'n', // A newline (linefeed) character (\n).
684+
chr( 13 ) => $backslash . 'r', // A carriage return character (\r).
684685
);
685-
return "'" . strtr( $literal, $replacements ) . "'";
686+
return "'" . strtr( $utf8_literal, $replacements ) . "'";
686687
}
687688

688689
/**

0 commit comments

Comments
 (0)