fix: improve identifier escaping validation#10283

Open

gr8man wants to merge 10 commits into

codeigniter4:developfrom

gr8man:fix/escape-identifiers-bypass

Commits on Jun 6, 2026

fix: escapeIdentifiers and protectIdentifiers SQL injection bypass
gr8man
committed

Commits on Jun 8, 2026

fix: nested transformer request scope leakage (#10281)

michalsn
authored and
gr8man
committed
Update system/Database/BaseConnection.php

gr8man
and
michalsn
committed
Update system/Database/BaseConnection.php

gr8man
and
michalsn
committed
fix: resolve syntax error and method names for escapeIdentifiers bypass
gr8man
committed
fix: require AS keyword for function/subquery aliases in isIdentifierEscapeExempt to prevent SQL injection bypass
gr8man
committed
refactor: simplify conditions in BaseConnection using Rector
gr8man
committed
fix: resolve subquery bare alias escape bypass regression and restore test expectations
gr8man
committed
fix: resolve PostgreSQL select function with comma escape protection regression
gr8man
committed
Merge branch 'codeigniter4:develop' into fix/escape-identifiers-bypass
gr8man
authored