Skip to content

[Autocomplete] Fix LIKE ESCAPE clause breaking search on PostgreSQL#3685

Open
Amoifr wants to merge 1 commit into
symfony:3.xfrom
Amoifr:fix-3668-autocomplete-like-escape-postgres
Open

[Autocomplete] Fix LIKE ESCAPE clause breaking search on PostgreSQL#3685
Amoifr wants to merge 1 commit into
symfony:3.xfrom
Amoifr:fix-3668-autocomplete-like-escape-postgres

Conversation

@Amoifr

@Amoifr Amoifr commented Jun 20, 2026

Copy link
Copy Markdown
Contributor
Q A
Bug fix? yes
New feature? no
Tickets Fix #3668
License MIT

Since 2.36, EntitySearchUtil escapes the LIKE wildcards (%, _) in the
autocomplete search query and pairs that with an ESCAPE '\' clause so the
escaped wildcards are treated literally.

That backslash breaks on PostgreSQL: with standard_conforming_strings = off
(older setups / some PDO driver versions) the backslash escapes the closing
quote of the SQL string literal, producing invalid SQL. It surfaces as
SQLSTATE[HY093] Invalid parameter number or
SQLSTATE[22025] invalid escape string and makes every text search throw.

Fix

Use a backslash-free LIKE escape character (!) via the platform's
escapeStringForLike(). The explicit ESCAPE clause is kept on purpose:
SQLite has no default LIKE escape character, so dropping it would silently
re-open the wildcard-injection the 2.36 hardening closed.

Note: the workaround suggested in the issue (escapeStringForLike($q, '\') +
removing the ESCAPE clause) wouldn't fully work — escapeStringForLike($q, '\')
produces byte-identical output to the current addcslashes($q, '\\%_'), so the
only effective change there is dropping ESCAPE, which regresses wildcard
escaping on SQLite. Switching the escape character is what actually fixes
PostgreSQL without that regression.

Tests

  • SQLite (CI): the existing testItEscapesLikeWildcardsInTheQuery is extended
    with a literal ! case and stays green — it can only pass if the ESCAPE
    clause works.
  • PostgreSQL (verified locally against a real server): the old ESCAPE '\'
    errors with standard_conforming_strings=off; the new ESCAPE '!' works
    under both settings and correctly matches literal %, _ and !.

The "ESCAPE '\'" clause added in 2.36 to escape LIKE wildcards produces
invalid SQL on PostgreSQL: with standard_conforming_strings=off the
backslash escapes the closing quote, breaking the statement (surfaces as
SQLSTATE[HY093] / [22025]).

Use a backslash-free escape character ("!") via the platform's
escapeStringForLike() instead. The explicit ESCAPE clause is kept since
SQLite has no default LIKE escape character.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ux-autocomplete] LIKE ESCAPE clause breaks search on PostgreSQL since v2.33

2 participants