stefangabos/Zebra_Database — pull request #13 by primeinc (2014-10-20 04:42:17+00:00)
Title: Fix backlashes injected by mysqli escape

I was trying to insert some binary data with null chars and ran into a weird problem, tracked it down to preg_replace requiring backslashes to be doubled if used inside of replacements.
```php
$original = "string\x00with\x00nulls\x00andDollar\\$23";
$replacements = $db->escape($original);
$randomstr = '/MD5VALUE/';
echo "Original PRE-REPLACED value: $original" . PHP_EOL;
echo "Escaped PRE-REPLACED value: $replacements" . PHP_EOL;
$sql = "MD5VALUE";
$replacements = '\'' . preg_replace('/\$([0-9]*)/', '\\\$$1',$replacements) . '\'';
$sql = preg_replace($randomstr, $replacements, $sql,1);
echo 'Currently inserted: ' . $sql . PHP_EOL;

$sql = "MD5VALUE";
$replacements = '\'' . preg_replace(array('/\\\\/','/\$([0-9]*)/'), array('\\\\\\\\','\\\$$1'), $db->escape($original)) . '\'';
$sql = preg_replace($randomstr, $replacements, $sql, 1);
echo 'Fixed: ' . $sql . PHP_EOL;
```
Output:
```
Original PRE-REPLACED value: stringwithnullsandDollar\$23
Escaped PRE-REPLACED value: string\0with\0nulls\0andDollar\\$23
Currently inserted: 'stringMD5VALUEwithMD5VALUEnullsMD5VALUEandDollar\$23'
Fixed: 'string\0with\0nulls\0andDollar\\$23'
```
Line 3111 also uses `preg_replace('/\$([0-9]*)/', '\\\$$1',$match[0])` but doesn't escape it with `mysqli_real_escape_string()` so I figured that didn't need to be changed. My problem was with the null char but I'm pretty sure this would have effected other things with backslashes, like \n or \r.