PgEscapedLiteralQuotedAgain

warning native on by default PHP ≥ 5.4

Group: Probable bugs

Use the already quoted PostgreSQL literal directly.

Example

<?php
function f($c) { $v=pg_escape_literal($c,'Bex'); pg_query($c,"SELECT '$v'"); }

Reported:

• line 2: Use the already quoted PostgreSQL literal directly.

Detection

• pg_escape_literal result is interpolated or concatenated into a constant SQL skeleton with additional single quotes immediately surrounding the entire escaped expression. Parse SQL quote boundaries; report the final query-producing expression. Unknown SQL structure and mixed escaping are excluded.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Both @custos-ignore PgEscapedLiteralQuotedAgain and @noinspection PgEscapedLiteralQuotedAgain suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. PostgreSQL literal/identifier escaping requires PHP 5.4.4 or later. Do not flag API unavailability through this rule.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "PgEscapedLiteralQuotedAgain": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PgEscapedLiteralQuotedAgain