{"id":"0b4243f0bbaa065a","repo":"laravel/framework","slug":"strings-with-invalid-utf-8-byte-sequences-cannot-b","errorCode":null,"errorMessage":"Strings with invalid UTF-8 byte sequences cannot be escaped.","messagePattern":"Strings with invalid UTF-8 byte sequences cannot be escaped\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Illuminate/Database/Connection.php","lineNumber":1186,"sourceCode":"    public function escape($value, $binary = false)\n    {\n        if ($value === null) {\n            return 'null';\n        } elseif ($binary) {\n            return $this->escapeBinary($value);\n        } elseif (is_int($value) || is_float($value)) {\n            return (string) $value;\n        } elseif (is_bool($value)) {\n            return $this->escapeBool($value);\n        } elseif (is_array($value)) {\n            throw new RuntimeException('The database connection does not support escaping arrays.');\n        } else {\n            if (str_contains($value, \"\\00\")) {\n                throw new RuntimeException('Strings with null bytes cannot be escaped. Use the binary escape option.');\n            }\n\n            if (preg_match('//u', $value) === false) {\n                throw new RuntimeException('Strings with invalid UTF-8 byte sequences cannot be escaped.');\n            }\n\n            return $this->escapeString($value);\n        }\n    }\n\n    /**\n     * Escape a string value for safe SQL embedding.\n     *\n     * @param  string  $value\n     * @return string\n     */\n    protected function escapeString($value)\n    {\n        return $this->getReadPdo()->quote($value);\n    }\n\n    /**","sourceCodeStart":1168,"sourceCodeEnd":1204,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Database/Connection.php#L1168-L1204","documentation":"Thrown by Connection::escape() when preg_match('//u', $value) fails, i.e. the string is not valid UTF-8. The driver-level quote()/escapeString assumes a valid encoding, so the framework bails rather than emit a malformed literal that could be misinterpreted by the server.","triggerScenarios":"Calling $connection->escape($string) on a string with invalid UTF-8 byte sequences (truncated multibyte char, legacy Latin-1 / ISO-8859-1 text, binary garbage masquerading as text).","commonSituations":"Importing legacy non-UTF-8 data; scraping HTML declared as a different encoding; reading a partial multibyte sequence from a stream; concatenating raw bytes from an external API.","solutions":["Fix the source encoding: convert before escaping with mb_convert_encoding($value, 'UTF-8', 'UTF-8') to drop invalid bytes, or from the real source encoding.","If the data is genuinely binary, use $connection->escape($value, binary: true).","Validate and sanitize input with iconv('UTF-8', 'UTF-8//IGNORE', $value) before escaping.","Bind the value as a parameter instead of escaping it inline, when the driver accepts the raw bytes."],"exampleFix":"// before\n$sql = '... where name = '.$conn->escape($dirtyLatin1);\n\n// after\n$clean = mb_convert_encoding($dirtyLatin1, 'UTF-8', 'UTF-8');\n$sql = '... where name = '.$conn->escape($clean);","handlingStrategy":"validation","validationCode":"if (is_string($value) && preg_match('//u', $value) === false) {\n    $value = mb_convert_encoding($value, 'UTF-8', 'UTF-8');\n    // or, if truly binary: $connection->escape($value, binary: true)\n}\n$literal = $connection->escape($value);","typeGuard":"function isValidUtf8(string $v): bool {\n    return preg_match('//u', $v) === 1;\n}","tryCatchPattern":null,"preventionTips":["Normalize inbound strings to UTF-8 at the boundary (mb_convert_encoding).","Detect and reject/clean invalid byte sequences before escaping.","Treat non-UTF-8 payloads as binary if they are genuinely binary.","Bind values as parameters when the driver accepts the raw bytes."],"tags":["escaping","encoding","utf-8","validation"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}