File php7-CVE-2026-17543.patch of Package php7

From ab048bd83b578119cf81b456526d50498421d617 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Mon, 27 Jul 2026 16:49:38 +0200
Subject: [PATCH] Fix SQL injection in ext-pgsql via E'...' backslash breakout

php_pgsql_add_quotes() quotes the string with E'...', but PQescapeStringConn()
does not escape \ unless standard_conforming_strings is off.
PQescapeStringConn() is meant to be used with '', so do that instead.

Fixes GHSA-7qpv-r5mr-78m4
---
 ext/pgsql/pgsql.c                            |  3 +-
 ext/pgsql/tests/10pg_convert_9.phpt          | 18 +++++-
 ext/pgsql/tests/10pg_convert_json_array.phpt |  4 +-
 ext/pgsql/tests/12pg_insert_9.phpt           |  2 +-
 ext/pgsql/tests/14pg_update_9.phpt           |  2 +-
 ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt     | 58 ++++++++++++++++++++
 ext/pgsql/tests/bug64609.phpt                |  2 +-
 ext/pgsql/tests/bug68638.phpt                |  2 +-
 8 files changed, 81 insertions(+), 10 deletions(-)
 create mode 100644 ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt

Index: php-7.4.33/ext/pgsql/pgsql.c
===================================================================
--- php-7.4.33.orig/ext/pgsql/pgsql.c
+++ php-7.4.33/ext/pgsql/pgsql.c
@@ -5839,7 +5839,6 @@ static int php_pgsql_add_quotes(zval *sr
 	assert(Z_TYPE_P(src) == IS_STRING);
 	assert(should_free == 1 || should_free == 0);
 
-	smart_str_appendc(&str, 'E');
 	smart_str_appendc(&str, '\'');
 	smart_str_appendl(&str, Z_STRVAL_P(src), Z_STRLEN_P(src));
 	smart_str_appendc(&str, '\'');