From fe407fdbba3599ce862134163d9eca92630ea7e0 Mon Sep 17 00:00:00 2001
From: Jon Stovell <jonstovell@gmail.com>
Date: Fri, 24 Oct 2025 00:51:05 -0600
Subject: [PATCH] Simplifies code in db query check

Signed-off-by: Jon Stovell <jonstovell@gmail.com>
---
 Sources/Subs-Db-mysql.php      | 16 +++++++++++++---
 Sources/Subs-Db-postgresql.php | 16 +++++++++++++---
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/Sources/Subs-Db-mysql.php b/Sources/Subs-Db-mysql.php
index 5972028c4f..38cb43b01d 100644
--- a/Sources/Subs-Db-mysql.php
+++ b/Sources/Subs-Db-mysql.php
@@ -368,14 +368,12 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 
 	// Comments that are allowed in a query are preg_removed.
 	static $allowed_comments_from = array(
-		'~(?<![\'\\\\])\'\X*?(?<![\'\\\\])\'~',
 		'~\s+~s',
 		'~/\*!40001 SQL_NO_CACHE \*/~',
 		'~/\*!40000 USE INDEX \([A-Za-z\_]+?\) \*/~',
 		'~/\*!40100 ON DUPLICATE KEY UPDATE id_msg = \d+ \*/~',
 	);
 	static $allowed_comments_to = array(
-		' %s ',
 		' ',
 		'',
 		'',
@@ -417,7 +415,19 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 	// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 	if (empty($modSettings['disableQueryCheck']))
 	{
-		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $db_string)));
+		$clean = preg_split('/(?<![\'\\\\])\'(?![\'])/', $db_string);
+
+		for ($i = 0; $i < count($clean); $i++)
+		{
+			if ($i % 2 === 1)
+				$clean[$i] = ' %s ';
+		}
+
+		$clean = trim(strtolower(preg_replace(
+			$allowed_comments_from,
+			$allowed_comments_to,
+			implode('', $clean)
+		)));
 
 		// Comments?  We don't use comments in our queries, we leave 'em outside!
 		if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false)
diff --git a/Sources/Subs-Db-postgresql.php b/Sources/Subs-Db-postgresql.php
index acca1a3eb7..6eaf3aae07 100644
--- a/Sources/Subs-Db-postgresql.php
+++ b/Sources/Subs-Db-postgresql.php
@@ -379,14 +379,12 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 
 	// Comments that are allowed in a query are preg_removed.
 	static $allowed_comments_from = array(
-		'~(?<![\'\\\\])\'\X*?(?<![\'\\\\])\'~',
 		'~\s+~s',
 		'~/\*!40001 SQL_NO_CACHE \*/~',
 		'~/\*!40000 USE INDEX \([A-Za-z\_]+?\) \*/~',
 		'~/\*!40100 ON DUPLICATE KEY UPDATE id_msg = \d+ \*/~',
 	);
 	static $allowed_comments_to = array(
-		' %s ',
 		' ',
 		'',
 		'',
@@ -415,7 +413,19 @@ function smf_db_query($identifier, $db_string, $db_values = array(), $connection
 	// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 	if (empty($modSettings['disableQueryCheck']))
 	{
-		$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $db_string)));
+		$clean = preg_split('/(?<![\'\\\\])\'(?![\'])/', $db_string);
+
+		for ($i = 0; $i < count($clean); $i++)
+		{
+			if ($i % 2 === 1)
+				$clean[$i] = ' %s ';
+		}
+
+		$clean = trim(strtolower(preg_replace(
+			$allowed_comments_from,
+			$allowed_comments_to,
+			implode('', $clean)
+		)));
 
 		// Comments?  We don't use comments in our queries, we leave 'em outside!
 		if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false)