CVE-2026-104457: Php Sqli Quote Wrapped Implode Sql Listcve-2026-104457-php-sqli-quote-wrapped-implode-sql-list
An array is joined with a tight quote-comma-quote separator (no spaces) and the joined text is wrapped directly in bare, matching SQL string-quote literals, building an unescaped SQL string-literal list by hand (for example the operand of a `col IN (...)` clause). Under MySQL/MariaDB default sql_mode an array element ending in a backslash escapes the auto-in
