Copilot SWE-agent changed wildcard escaping without matching native PostgreSQL SQL, so unauthenticated searches could force broad scans and degrade availability.

How AI contributed: Direct introductionPublished Aug 4, 2026 in thorsten/phpmyfaqAll 2 findings in this repository

Show full advisory description

When phpMyFAQ uses PostgreSQL through the native pgsql PHP extension, public FAQ search interpolates the unauthenticated search parameter into Pgsql::search() as (%s) ILIKE ('%%%s%%') after SearchDatabase::escapeLikeWildcards(). That helper prefixes user % and _ with |, which only disables LIKE wildcards if the SQL also declares ESCAPE '|'. Native Pgsql.php did not: the commit that introduced the | escaping declared no ESCAPE clause on this statement, and a later 4.1 merge left it declaring ESCAPE '=' (PostgreSQL's default LIKE escape is backslash). In both states | is a literal, so attacker-supplied %/_ stay active wildcards, forcing maximally broad ILIKE matches and expensive sequential scans (availability DoS). Quotes are still passed through getDb()->escape(), so this is not quote-breaking SQL injection. The PDO sibling PdoPgsql.php declares ESCAPE '|' and is not affected.

Root cause

Injection & unsafe execution introduced

fix: use pipe character as LIKE ESCAPE to work across all databases

AI-assisted change: GitHub Copilot

086c8ad58f

phpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php phpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php phpmyfaq/src/phpMyFAQ/Search.php

Fix

Security fix

fix(search): align native pgsql LIKE ESCAPE character with the wildcard escaper

Fix by Thorsten Rinne · no AI marker found

17b7f5b0e1

phpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php phpmyfaq/src/phpMyFAQ/Search/Database/Pgsql.php phpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php

Case facts

CVE ID: CVE-2026-76212
GHSA ID: GHSA-5HX6-C293-588H
Published: Aug 4, 2026
Severity: Not scored
Language: PHP
AI tool: GitHub Copilot
AI role: Direct introduction
Vulnerable release: 4.1-nightly-2026-04-17 through < 4.1-nightly-2026-08-02
Fixed release: 4.1-nightly-2026-08-02

Advisory source

AI-assisted change

AI-assisted changephpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php source thorsten/phpmyfaq@086c8ad58f+2−2

@@ -264,7 +264,7 @@ public function getMatchClause(string $searchTerm = ''): string                 }                  $where = sprintf(

Show 6 hidden lines

-                    "%s%s LIKE '%%%s%%' ESCAPE '\\\\'",+                    "%s%s LIKE '%%%s%%' ESCAPE '|'",                     $where,                     $this->matchingColumns[$j],                     self::escapeLikeWildcards($this->configuration->getDb()->escape($keys[$i])),@@ -292,6 +292,6 @@ public function disableRelevance(): void

      */     protected static function escapeLikeWildcards(string $term): string     {-        return str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $term);+        return str_replace(['|', '%', '_'], ['||', '|%', '|_'], $term);     } }

The flawed mechanism was first written by Copilot SWE-agent commit 086c8ad58f91a8e34ea27fabd1ba9ca0b2487f42 (GitHub PR 4180 rebase onto main), which changed escapeLikeWildcards() and the PDO/generic LIKE clauses from backslash to | “to work across all databases” but left native Pgsql.php untouched. That file already called the shared escaper while emitting ILIKE ('%%%s%%') with no ESCAPE clause. At the immediate parent the escaper still used \, matching PostgreSQL’s default LIKE escape, so native wildcard neutralization still held. After 086c the native backend’s escaping is a no-op. Merge 8853a0fa8 later brought 4.1’s consistent ESCAPE '=' rewrite (df54d00ce) onto main’s | escaper, which is the exact '=' vs '|' pair in GHSA-5hx6-c293-588h / CVE-2026-76212; that merge only layers 4.1’s rewrite onto main’s escaper, so the mismatch itself still originates at 086c8ad5. 4.1.5–4.1.7 keep matching '='/'=' and do not contain this mismatch.

AI-assisted changephpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php source thorsten/phpmyfaq@086c8ad58f+1−1

@@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed                 FROM                     %s %s %s %s                 WHERE-                    (%s) ILIKE ('%%%s%%') ESCAPE '\\\\'+                    (%s) ILIKE ('%%%s%%') ESCAPE '|'                     %s                     %s",             $columns,

Switches the PDO PostgreSQL search clause from backslash escaping to a pipe escape declaration, updating this driver while the native PostgreSQL backend keeps its unmatched default.

AI-assisted changephpmyfaq/src/phpMyFAQ/Search.php source thorsten/phpmyfaq@086c8ad58f+2−2

@@ -247,9 +247,9 @@ private function searchCustomPages(string $searchTerm, bool $allLanguages = true             }              // Escape LIKE metacharacters (%, _) to prevent wildcard injection-            $escapedWord = str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $word);+            $escapedWord = str_replace(['|', '%', '_'], ['||', '|%', '|_'], $word);             $searchConditions[] = sprintf(-                "(page_title LIKE '%%%s%%' ESCAPE '\\\\' OR content LIKE '%%%s%%' ESCAPE '\\\\')",+                "(page_title LIKE '%%%s%%' ESCAPE '|' OR content LIKE '%%%s%%' ESCAPE '|')",                 $escapedWord,                 $escapedWord,             );

Switches custom-page search escaping from backslash prefixes to pipe prefixes with matching escape clauses, changing the convention whose incomplete adoption left native wildcard escaping disabled.

Security fix

Fixphpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php source thorsten/phpmyfaq@17b7f5b0e1+12−2

@@ -28,6 +28,13 @@  */ class SearchDatabase extends AbstractSearch implements SearchInterface {+    /**+     * LIKE/ILIKE escape character. Every ESCAPE clause built by this class or+     * its driver subclasses must use this character, otherwise the wildcard+     * escaping in escapeLikeWildcards() is silently disabled.+     */+    protected const string LIKE_ESCAPE_CHARACTER = '|';+     /**      * Searching database table.

Show 6 hidden lines

      */@@ -282,10 +289,11 @@ public function getMatchClause(string $searchTerm = ''): string                 }                  $where = sprintf(-                    "%s%s LIKE '%%%s%%' ESCAPE '|'",

+                    "%s%s LIKE '%%%s%%' ESCAPE '%s'",                     $where,                     $this->matchingColumns[$j],                     self::escapeLikeWildcards($this->configuration->getDb()->escape((string) $keys[$i])),+                    self::LIKE_ESCAPE_CHARACTER,                 );             } @@ -310,6 +318,8 @@ public function disableRelevance(): void      */     protected static function escapeLikeWildcards(string $term): string     {-        return str_replace(['|', '%', '_'], ['||', '|%', '|_'], $term);+        $escape = self::LIKE_ESCAPE_CHARACTER;++        return str_replace([$escape, '%', '_'], [$escape . $escape, $escape . '%', $escape . '_'], $term);     }

Show 1 hidden lines

Defines the search escape character once and derives both the matching clause and the wildcard escaper from it, so driver SQL and escaping logic can no longer drift apart.

Fixphpmyfaq/src/phpMyFAQ/Search/Database/Pgsql.php source thorsten/phpmyfaq@17b7f5b0e1+2−1

@@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed                 FROM                     %s %s %s %s                 WHERE-                    (%s) ILIKE ('%%%s%%') ESCAPE '='+                    (%s) ILIKE ('%%%s%%') ESCAPE '%s'                     %s                     %s",             $columns,@@ -86,6 +86,7 @@ public function search(string $searchTerm): mixed                 : '',             $this->getMatchingColumns(),             self::escapeLikeWildcards($this->configuration->getDb()->escape($searchTerm)),+            self::LIKE_ESCAPE_CHARACTER,             $this->getConditions(),             $orderBy,         );

Formats the native PostgreSQL clause's escape declaration from the shared constant, replacing the hardcoded mismatch that left user wildcards active in public search.

Fixphpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php source thorsten/phpmyfaq@17b7f5b0e1+2−1

@@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed                 FROM                     %s %s %s %s                 WHERE-                    (%s) ILIKE ('%%%s%%') ESCAPE '|'+                    (%s) ILIKE ('%%%s%%') ESCAPE '%s'                     %s                     %s",             $columns,@@ -86,6 +86,7 @@ public function search(string $searchTerm): mixed                 : '',             $this->getMatchingColumns(),             self::escapeLikeWildcards($this->configuration->getDb()->escape($searchTerm)),+            self::LIKE_ESCAPE_CHARACTER,             $this->getConditions(),             $orderBy,         );

Formats the PDO PostgreSQL clause's escape declaration from the same shared constant, keeping both drivers locked to the wildcard escaper instead of duplicated literals.

Patch fingerprints

AI-assisted change 95699c648d832676e803ff14f93ca21bf1360df23223fd70a959d4b02316a649 · Fix 5644cac5dae8bf767eca57f778f2da851ad635a60bd8ac388495aea9b9cfd1ce

Copilot SWE-agent changed wildcard escaping without matching native PostgreSQL SQL, so unauthenticated searches could force broad scans and degrade availability.

Show full advisory description

AI-assisted change

AI-assisted changephpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php source thorsten/phpmyfaq@086c8ad58f+2−2

@@ -264,7 +264,7 @@ public function getMatchClause(string $searchTerm = ''): string                 }                  $where = sprintf(

Show 6 hidden lines

-                    "%s%s LIKE '%%%s%%' ESCAPE '\\\\'",+                    "%s%s LIKE '%%%s%%' ESCAPE '|'",                     $where,                     $this->matchingColumns[$j],                     self::escapeLikeWildcards($this->configuration->getDb()->escape($keys[$i])),@@ -292,6 +292,6 @@ public function disableRelevance(): void

      */     protected static function escapeLikeWildcards(string $term): string     {-        return str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $term);+        return str_replace(['|', '%', '_'], ['||', '|%', '|_'], $term);     } }

AI-assisted changephpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php source thorsten/phpmyfaq@086c8ad58f+1−1

@@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed                 FROM                     %s %s %s %s                 WHERE-                    (%s) ILIKE ('%%%s%%') ESCAPE '\\\\'+                    (%s) ILIKE ('%%%s%%') ESCAPE '|'                     %s                     %s",             $columns,

Switches the PDO PostgreSQL search clause from backslash escaping to a pipe escape declaration, updating this driver while the native PostgreSQL backend keeps its unmatched default.

AI-assisted changephpmyfaq/src/phpMyFAQ/Search.php source thorsten/phpmyfaq@086c8ad58f+2−2

@@ -247,9 +247,9 @@ private function searchCustomPages(string $searchTerm, bool $allLanguages = true             }              // Escape LIKE metacharacters (%, _) to prevent wildcard injection-            $escapedWord = str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $word);+            $escapedWord = str_replace(['|', '%', '_'], ['||', '|%', '|_'], $word);             $searchConditions[] = sprintf(-                "(page_title LIKE '%%%s%%' ESCAPE '\\\\' OR content LIKE '%%%s%%' ESCAPE '\\\\')",+                "(page_title LIKE '%%%s%%' ESCAPE '|' OR content LIKE '%%%s%%' ESCAPE '|')",                 $escapedWord,                 $escapedWord,             );

Switches custom-page search escaping from backslash prefixes to pipe prefixes with matching escape clauses, changing the convention whose incomplete adoption left native wildcard escaping disabled.

Security fix

Fixphpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php source thorsten/phpmyfaq@17b7f5b0e1+12−2

@@ -28,6 +28,13 @@  */ class SearchDatabase extends AbstractSearch implements SearchInterface {+    /**+     * LIKE/ILIKE escape character. Every ESCAPE clause built by this class or+     * its driver subclasses must use this character, otherwise the wildcard+     * escaping in escapeLikeWildcards() is silently disabled.+     */+    protected const string LIKE_ESCAPE_CHARACTER = '|';+     /**      * Searching database table.

Show 6 hidden lines

      */@@ -282,10 +289,11 @@ public function getMatchClause(string $searchTerm = ''): string                 }                  $where = sprintf(-                    "%s%s LIKE '%%%s%%' ESCAPE '|'",

+                    "%s%s LIKE '%%%s%%' ESCAPE '%s'",                     $where,                     $this->matchingColumns[$j],                     self::escapeLikeWildcards($this->configuration->getDb()->escape((string) $keys[$i])),+                    self::LIKE_ESCAPE_CHARACTER,                 );             } @@ -310,6 +318,8 @@ public function disableRelevance(): void      */     protected static function escapeLikeWildcards(string $term): string     {-        return str_replace(['|', '%', '_'], ['||', '|%', '|_'], $term);+        $escape = self::LIKE_ESCAPE_CHARACTER;++        return str_replace([$escape, '%', '_'], [$escape . $escape, $escape . '%', $escape . '_'], $term);     }

Show 1 hidden lines

Defines the search escape character once and derives both the matching clause and the wildcard escaper from it, so driver SQL and escaping logic can no longer drift apart.

Fixphpmyfaq/src/phpMyFAQ/Search/Database/Pgsql.php source thorsten/phpmyfaq@17b7f5b0e1+2−1

@@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed                 FROM                     %s %s %s %s                 WHERE-                    (%s) ILIKE ('%%%s%%') ESCAPE '='+                    (%s) ILIKE ('%%%s%%') ESCAPE '%s'                     %s                     %s",             $columns,@@ -86,6 +86,7 @@ public function search(string $searchTerm): mixed                 : '',             $this->getMatchingColumns(),             self::escapeLikeWildcards($this->configuration->getDb()->escape($searchTerm)),+            self::LIKE_ESCAPE_CHARACTER,             $this->getConditions(),             $orderBy,         );

Formats the native PostgreSQL clause's escape declaration from the shared constant, replacing the hardcoded mismatch that left user wildcards active in public search.

Fixphpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php source thorsten/phpmyfaq@17b7f5b0e1+2−1

@@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed                 FROM                     %s %s %s %s                 WHERE-                    (%s) ILIKE ('%%%s%%') ESCAPE '|'+                    (%s) ILIKE ('%%%s%%') ESCAPE '%s'                     %s                     %s",             $columns,@@ -86,6 +86,7 @@ public function search(string $searchTerm): mixed                 : '',             $this->getMatchingColumns(),             self::escapeLikeWildcards($this->configuration->getDb()->escape($searchTerm)),+            self::LIKE_ESCAPE_CHARACTER,             $this->getConditions(),             $orderBy,         );

Formats the PDO PostgreSQL clause's escape declaration from the same shared constant, keeping both drivers locked to the wildcard escaper instead of duplicated literals.