zendframework/zf2 — pull request #3974 by ralphschindler (2013-03-06 20:12:54+00:00)
Title: Insecure value quoting/escaping in platform implementations

In almost all platform implementation value quoting is done by doing this:

```php
return '\'' . str_replace('\'', '\\' . '\'', $value) . '\'';
```

This is insecure and an attacker could inject sql by simply providing:

'\'; DELETE FROM some_table; -- '

This would become:

'\\'; DELETE FROM some_table; -- '

Since the the single backslash is now escaped the literal ends at ";" and the Injected statement will become part of the SQL.

You should switch to add(c)slashes or better to the appropriate platform specific method (mysql_escape_string, etc ...).

Also `quoteValueList()` should utilize `quoteValue()` instead of using copy & paste code.