From 7bd058b839adc1306d39e23df7c8b54bec8e8ebf Mon Sep 17 00:00:00 2001
From: Shawn Bulen <bulens@pacbell.net>
Date: Thu, 23 Oct 2025 09:32:35 -0700
Subject: [PATCH] Fix string literal detection & removal

Signed-off-by: Shawn Bulen <bulens@pacbell.net>
---
 Sources/Subs-Db-mysql.php      | 6 ++++--
 Sources/Subs-Db-postgresql.php | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Sources/Subs-Db-mysql.php b/Sources/Subs-Db-mysql.php
index 5972028c4f..1713608d12 100644
--- a/Sources/Subs-Db-mysql.php
+++ b/Sources/Subs-Db-mysql.php
@@ -368,7 +368,7 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 
 	// Comments that are allowed in a query are preg_removed.
 	static $allowed_comments_from = array(
-		'~(?<![\'\\\\])\'\X*?(?<![\'\\\\])\'~',
+		'~\'\X*?\'~s',
 		'~\s+~s',
 		'~/\*!40001 SQL_NO_CACHE \*/~',
 		'~/\*!40000 USE INDEX \([A-Za-z\_]+?\) \*/~',
@@ -417,7 +417,9 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 	// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 	if (empty($modSettings['disableQueryCheck']))
 	{
-		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $db_string)));
+		// Clear out escaped backslashes & single quotes first, to make it simpler to ID & remove string literals
+		$clean = str_replace(array('\\\\', '\\\''), array('', ''), $db_string);
+		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $clean)));
 
 		// Comments?  We don't use comments in our queries, we leave 'em outside!
 		if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false)
diff --git a/Sources/Subs-Db-postgresql.php b/Sources/Subs-Db-postgresql.php
index acca1a3eb7..45e5d9628a 100644
--- a/Sources/Subs-Db-postgresql.php
+++ b/Sources/Subs-Db-postgresql.php
@@ -379,7 +379,7 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 
 	// Comments that are allowed in a query are preg_removed.
 	static $allowed_comments_from = array(
-		'~(?<![\'\\\\])\'\X*?(?<![\'\\\\])\'~',
+		'~\'\X*?\'~s',
 		'~\s+~s',
 		'~/\*!40001 SQL_NO_CACHE \*/~',
 		'~/\*!40000 USE INDEX \([A-Za-z\_]+?\) \*/~',
@@ -415,7 +415,9 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 	// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 	if (empty($modSettings['disableQueryCheck']))
 	{
-		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $db_string)));
+		// Clear out escaped single quotes first, to make it simpler to ID & remove string literals
+		$clean = str_replace('\'\'', '', $db_string);
+		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $clean)));
 
 		// Comments?  We don't use comments in our queries, we leave 'em outside!
 		if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false)