Skip to content
This repository was archived by the owner on Nov 6, 2026. It is now read-only.

Improve escaping in HasCastable.php #44

Merged
andrey-helldar merged 1 commit into from
Nov 6, 2026
Merged

Improve escaping in HasCastable.php #44

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/Concerns/HasCastable.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,6 @@ protected function castValue(mixed $value = null): float|int|string
return '[]';
}

return "'" . addslashes($value) . "'";
return "'" . str_replace(['\\', "'"], ['\\\\', "\\'"], stripslashes($value)) . "'";

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve literal backslashes before escaping string values

When an input string contains literal backslashes, stripslashes($value) removes them before the replacement can escape them. For example, C:\temp\file.txt becomes 'C:tempfile.txt', and App\Models\User becomes 'AppModelsUser'. The PHP formatter passes original array values directly to castValue(), so these are not previously escaped strings that need decoding. This silently corrupts paths, class names, and other backslash-containing values in the generated PHP. Remove the stripslashes() call and escape the original value directly.

Useful? React with 👍 / 👎.

}
}
Loading