Merge branch 'release-3.0' of github.com:SimpleMachines/SMF into reactions

Author: Oldiesmann

Sources/Db/APIs/MySQL.php

@@ -169,7 +169,7 @@ public function query(string $db_string, array $db_values = [], ?object $connect
 
 		// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 		if (!$this->disableQueryCheck) {
-			$clean = preg_split('/(?<![\'\\\\])\'(?![\'])/', $db_string);
+			$clean = preg_split('/(?:\\\\{2})*\K(?<![\'\\\\])\'(?![\'])/', $db_string);
 
 			for ($i = 0; $i < \count($clean); $i++) {
 				if ($i % 2 === 1) {

Sources/Db/APIs/PostgreSQL.php

@@ -177,12 +177,14 @@ public function query(string $db_string, array $db_values = [], ?object $connect
 
 		// Comments that are allowed in a query are preg_removed.
 		$allowed_comments_from = [
+			'~\'\X*?\'~s',
 			'~\s+~s',
 			'~/\*!40001 SQL_NO_CACHE \*/~',
 			'~/\*!40000 USE INDEX \([A-Za-z\_]+?\) \*/~',
 			'~/\*!40100 ON DUPLICATE KEY UPDATE id_msg = \d+ \*/~',
 		];
 		$allowed_comments_to = [
+			' %s ',
 			' ',
 			'',
 			'',
@@ -216,19 +218,9 @@ public function query(string $db_string, array $db_values = [], ?object $connect
 
 		// First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over.
 		if (!$this->disableQueryCheck) {
-			$clean = preg_split('/(?<![\'\\\\])\'(?![\'])/', $db_string);
-
-			for ($i = 0; $i < \count($clean); $i++) {
-				if ($i % 2 === 1) {
-					$clean[$i] = ' %s ';
-				}
-			}
-
-			$clean = trim(strtolower(preg_replace(
-				$allowed_comments_from,
-				$allowed_comments_to,
-				implode('', $clean),
-			)));
+			// Clear out escaped single quotes first, to make it simpler to ID & remove string literals
+			$clean = str_replace('\'\'', ' ', $db_string);
+			$clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $clean)));
 
 			if (
 				// Empty string?
@@ -1813,10 +1805,11 @@ public function create_table(string $table_name, array $columns, array $indexes
 				$default = 'default nextval(\'' . $short_table_name . '_seq\')';
 			} elseif (isset($column['default']) && $column['default'] !== null) {
 				// Numbers don't need quotes.
-				if (is_numeric($column['default']))
+				if (is_numeric($column['default'])) {
 					$default = 'default ' . $column['default'];
-				else
+				} else {
 					$default = 'default \'' . $this->escape_string($column['default']) . '\'';
+				}
 			} else {
 				$default = '';
 			}

Sources/ErrorHandler.php

@@ -280,7 +280,6 @@ public static function log(string $error_message, string|bool $error_type = 'gen
 			time(),
 			User::$me->ip ?? IP::getUserIP(),
 			$request_url,
-			$query_string,
 			$error_message,
 			(string) (User::$sc ?? ''),
 			$error_type,