{"id":"afa4e2ca35e615c7","repo":"laravel/framework","slug":"strings-with-null-bytes-cannot-be-escaped-use-the","errorCode":null,"errorMessage":"Strings with null bytes cannot be escaped. Use the binary escape option.","messagePattern":"Strings with null bytes cannot be escaped\\. Use the binary escape option\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/Illuminate/Database/Connection.php","lineNumber":1182,"sourceCode":"     * @return string\n     *\n     * @throws \\RuntimeException\n     */\n    public function escape($value, $binary = false)\n    {\n        if ($value === null) {\n            return 'null';\n        } elseif ($binary) {\n            return $this->escapeBinary($value);\n        } elseif (is_int($value) || is_float($value)) {\n            return (string) $value;\n        } elseif (is_bool($value)) {\n            return $this->escapeBool($value);\n        } elseif (is_array($value)) {\n            throw new RuntimeException('The database connection does not support escaping arrays.');\n        } else {\n            if (str_contains($value, \"\\00\")) {\n                throw new RuntimeException('Strings with null bytes cannot be escaped. Use the binary escape option.');\n            }\n\n            if (preg_match('//u', $value) === false) {\n                throw new RuntimeException('Strings with invalid UTF-8 byte sequences cannot be escaped.');\n            }\n\n            return $this->escapeString($value);\n        }\n    }\n\n    /**\n     * Escape a string value for safe SQL embedding.\n     *\n     * @param  string  $value\n     * @return string\n     */\n    protected function escapeString($value)\n    {","sourceCodeStart":1164,"sourceCodeEnd":1200,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Database/Connection.php#L1164-L1200","documentation":"Thrown by Connection::escape() when a string value contains a null byte (\"\\00\"). Null bytes can truncate or terminate SQL on some drivers, so the framework refuses to embed them as text. Such payloads are almost always binary and must be escaped via the binary escape path.","triggerScenarios":"Calling $connection->escape($string) where $string contains embedded NUL bytes; reading encrypted/blob column data into a string then escaping it; concatenating binary UUID (16 raw bytes) into a query.","commonSituations":"Storing binary UUIDs, encrypted blobs, serialized binary payloads, image headers, or data read from a binary file with file_get_contents().","solutions":["Pass the binary flag: $connection->escape($value, binary: true) so escapeBinary() is used.","Store the value via a prepared statement with ? binding rather than escaping into the SQL string.","Use the AsBinary cast / BinaryCodec for binary UUID/ULID columns on Eloquent models.","Detect and reject NUL bytes early if the field is supposed to be text (str_contains($v, \"\\0\"))."],"exampleFix":"// before\n$sql = '... where signature = '.$conn->escape($blob);\n\n// after\n$sql = '... where signature = '.$conn->escape($blob, binary: true);\n// or preferred:\nDB::table('t')->where('signature', $blob)->get();","handlingStrategy":"validation","validationCode":"if (is_string($value) && str_contains($value, \"\\0\")) {\n    // it's binary: use binary escape or bind\n    $literal = $connection->escape($value, binary: true);\n} else {\n    $literal = $connection->escape($value);\n}","typeGuard":"function looksBinary(string $v): bool {\n    return str_contains($v, \"\\0\");\n}","tryCatchPattern":null,"preventionTips":["Use parameter binding instead of inline-escaping binary data.","Model binary columns with the AsBinary cast so encoding is automatic.","Validate input strings for NUL bytes early when they should be text.","When escaping, pass binary: true for blobs/UUIDs/encrypted data."],"tags":["escaping","binary","sql-injection"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}