Merge pull request #9043 from sbulen/21_query_check_fix3

[2.1] Fix string literal cleanup - take 3

Author: jdarwood007

Sources/Subs-Db-mysql.php

@@ -368,12 +368,14 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 
 	// Comments that are allowed in a query are preg_removed.
 	static $allowed_comments_from = array(
+		'~\'\X*?\'~s',
 		'~\s+~s',
 		'~/\*!40001 SQL_NO_CACHE \*/~',
 		'~/\*!40000 USE INDEX \([A-Za-z\_]+?\) \*/~',
 		'~/\*!40100 ON DUPLICATE KEY UPDATE id_msg = \d+ \*/~',
 	);
 	static $allowed_comments_to = array(
+		' %s ',
 		' ',
 		'',
 		'',
@@ -415,19 +417,9 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 	// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 	if (empty($modSettings['disableQueryCheck']))
 	{
-		$clean = preg_split('/(?:\\\\{2})*\K(?<![\'\\\\])\'(?![\'])/', $db_string);
-
-		for ($i = 0; $i < count($clean); $i++)
-		{
-			if ($i % 2 === 1)
-				$clean[$i] = ' %s ';
-		}
-
-		$clean = trim(strtolower(preg_replace(
-			$allowed_comments_from,
-			$allowed_comments_to,
-			implode('', $clean)
-		)));
+		// Clear out escaped backslashes & single quotes first, to make it simpler to ID & remove string literals
+		$clean = str_replace(array('\\\\', '\\\'', '\'\''), array('', '', ''), $db_string);
+		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $clean)));
 
 		// Comments?  We don't use comments in our queries, we leave 'em outside!
 		if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false)