Bug #72225 [Opn->Nab]: NULL is not correct escaped by mysqli.real-escape-string

Edit report at https://bugs.php.net/bug.php?id=72225&edit=1 ID: 72225 Updated by: requinix@php.net Reported by: dc at ftb-esv dot de Summary: NULL is not correct escaped by mysqli.real-escape-string -Status: Open +Status: Not a bug Type: Bug -Package: *General Issues +Package: MySQLi related Operating System: Linux PHP Version: 5.5.35 Block user comment: N Private report: N New Comment: MySQL does not have octal escape sequences. mysql> SELECT "a\01b"; +------+ | a | +------+ | a 1b | +------+ 1 row in set (0.00 sec) mysql> SELECT HEX("a\01b"); +--------------+ | HEX("a\01b") | +--------------+ | 61003162 | +--------------+ 1 row in set (0.07 sec) Previous Comments: ------------------------------------------------------------------------ [2016-05-16 17:27:45] dc at ftb-esv dot de Description: ------------ --- From manual page: http://www.php.net/mysqli.real-escape-string --- real_escape_string escapes a NULL to "\0", but this is wrong! It must be escaped to "\000" or conversions are wrong, if a digit follows. Test script: --------------- $a = "a\000" . "1b"; echo mysqli->real_escape_string($a); RESULT: a\01b => 'a' . '\01' . 'b' ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72225&edit=1