From 6dce01511b1dfeeda3a042cc972c78c00ce0a69c Mon Sep 17 00:00:00 2001
From: Mark Story <mark@mark-story.com>
Date: Mon, 29 Jun 2026 12:06:34 -0400
Subject: [PATCH 1/3] Add escaping to hasDatabase()

We should escape this value to prevent it from being flagged by security
researchers.
---
 src/Db/Adapter/PostgresAdapter.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Db/Adapter/PostgresAdapter.php b/src/Db/Adapter/PostgresAdapter.php
index bb204b68..8aaeff77 100644
--- a/src/Db/Adapter/PostgresAdapter.php
+++ b/src/Db/Adapter/PostgresAdapter.php
@@ -984,7 +984,7 @@ public function createDatabase(string $name, array $options = []): void
      */
     public function hasDatabase(string $name): bool
     {
-        $sql = sprintf("SELECT count(*) FROM pg_database WHERE datname = '%s'", $name);
+        $sql = sprintf("SELECT count(*) FROM pg_database WHERE datname = '%s'", $this->quoteSchemaName($name));
         $result = $this->fetchRow($sql);
         if (!$result) {
             return false;

From 4646500dc08ea9a2c82fa7a98be4222b5d316db2 Mon Sep 17 00:00:00 2001
From: Mark Story <mark@mark-story.com>
Date: Mon, 29 Jun 2026 12:26:11 -0400
Subject: [PATCH 2/3] Use prepared statement

---
 src/Db/Adapter/PostgresAdapter.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/Db/Adapter/PostgresAdapter.php b/src/Db/Adapter/PostgresAdapter.php
index 8aaeff77..988659d5 100644
--- a/src/Db/Adapter/PostgresAdapter.php
+++ b/src/Db/Adapter/PostgresAdapter.php
@@ -984,8 +984,11 @@ public function createDatabase(string $name, array $options = []): void
      */
     public function hasDatabase(string $name): bool
     {
-        $sql = sprintf("SELECT count(*) FROM pg_database WHERE datname = '%s'", $this->quoteSchemaName($name));
-        $result = $this->fetchRow($sql);
+        $connection = $this->getConnection();
+        $result = $connection->execute(
+            'SELECT count(*) FROM pg_database WHERE datname = ?',
+            [$name]
+        )->fetch('assoc');
         if (!$result) {
             return false;
         }

From 1b53a2f236b94d1c3cd0139e2b7cfe841b62ae2b Mon Sep 17 00:00:00 2001
From: Mark Story <mark@mark-story.com>
Date: Mon, 29 Jun 2026 22:01:16 -0400
Subject: [PATCH 3/3] Fix phpcs error

---
 src/Db/Adapter/PostgresAdapter.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Db/Adapter/PostgresAdapter.php b/src/Db/Adapter/PostgresAdapter.php
index 988659d5..1f291c4e 100644
--- a/src/Db/Adapter/PostgresAdapter.php
+++ b/src/Db/Adapter/PostgresAdapter.php
@@ -987,7 +987,7 @@ public function hasDatabase(string $name): bool
         $connection = $this->getConnection();
         $result = $connection->execute(
             'SELECT count(*) FROM pg_database WHERE datname = ?',
-            [$name]
+            [$name],
         )->fetch('assoc');
         if (!$result) {
             return false;