note 98079 added to sqlite3.escapestring

I seems that the function only escapes single quote ' and left double quote " untouched. <?php $database_filename = "database.db"; $dbhandle = new SQLite3($database_filename, $mode=0666, $sqliteerror); $escape_result = $dbhandle->escapeString("testing's is \"fun\"."); print "$escape_result\n"; ?> The result would be: testing''s is "fun". So, please use single quote to quote text in sqlite query. <?php // this should be OK $sql = sprintf("INSERT INTO table1 (somestr1, somestr2) VALUES ('%s', '%s')", $dbhandle->($somestr1), $dbhandle->($somestr1)); $dbhandle->query($sql); // this would be vulnerable to injection $sql = sprintf('INSERT INTO table1 (somestr1, somestr2) VALUES ("%s", "%s")', $dbhandle->($somestr1), $dbhandle->($somestr1)); $dbhandle->query($sql); ?> ---- Server IP: 69.147.83.197 Probable Submitter: 59.148.91.119 ---- Manual Page -- http://www.php.net/manual/en/sqlite3.escapestring.php Edit -- https://master.php.net/note/edit/98079 Del: integrated -- https://master.php.net/note/delete/98079/integrated Del: useless -- https://master.php.net/note/delete/98079/useless Del: bad code -- https://master.php.net/note/delete/98079/bad+code Del: spam -- https://master.php.net/note/delete/98079/spam Del: non-english -- https://master.php.net/note/delete/98079/non-english Del: in docs -- https://master.php.net/note/delete/98079/in+docs Del: other reasons-- https://master.php.net/note/delete/98079 Reject -- https://master.php.net/note/reject/98079 Search -- https://master.php.net/manage/user-notes.php