@@ -2825,8 +2825,6 @@ private function read_number(): ?int {
28252825 * Rules:
28262826 * 1. Quotes can be escaped by doubling them ('', "", ``).
28272827 * 2. Backslashes escape the next character, unless NO_BACKSLASH_ESCAPES is set.
2828- *
2829- * @param string $quote The quote character - ', ", or `.
28302828 */
28312829 private function read_quoted_text (): ?int {
28322830 $ quote = $ this ->sql [ $ this ->bytes_already_read ];
@@ -2842,6 +2840,11 @@ private function read_quoted_text(): ?int {
28422840 while ( true ) {
28432841 $ at += strcspn ( $ this ->sql , $ quote , $ at );
28442842
2843+ // Unclosed string - unexpected EOF.
2844+ if ( ( $ this ->sql [ $ at ] ?? null ) !== $ quote ) {
2845+ return null ; // Invalid input.
2846+ }
2847+
28452848 /*
28462849 * By default, quotes can be escaped with a "\".
28472850 * When NO_BACKSLASH_ESCAPES SQL mode is active, the "\" treated as
@@ -2852,18 +2855,13 @@ private function read_quoted_text(): ?int {
28522855 * "\\\" is an escaped backslash and an escape sequence, and so on.
28532856 */
28542857 if ( ! $ no_backslash_escapes ) {
2855- for ($ i = 0 ; '\\' === $ this ->sql [ $ at - $ i - 1 ]; $ i += 1 );
2858+ for ( $ i = 0 ; ( $ at - $ i - 1 ) >= 0 && '\\' === $ this ->sql [ $ at - $ i - 1 ]; $ i += 1 );
28562859 if ( 1 === $ i % 2 ) {
28572860 $ at += 1 ;
28582861 continue ;
28592862 }
28602863 }
28612864
2862- // Unclosed string - unexpected EOF.
2863- if ( ( $ this ->sql [ $ at ] ?? null ) !== $ quote ) {
2864- return null ; // Invalid input.
2865- }
2866-
28672865 // Check if the quote is doubled.
28682866 if ( ( $ this ->sql [ $ at + 1 ] ?? null ) === $ quote ) {
28692867 $ at += 2 ;
0 commit comments