From 6876029e59d0d282ab679198cfbdcbee1f81fd67 Mon Sep 17 00:00:00 2001
From: Ostap Brehin <osbre@protonmail.com>
Date: Sun, 20 Sep 2026 00:19:42 +0100
Subject: [PATCH] fix(database): escape quote characters in identifiers

---
 .../database/src/Config/DatabaseDialect.php   |  4 +--
 .../tests/Config/DatabaseDialectTest.php      | 28 +++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 packages/database/tests/Config/DatabaseDialectTest.php

diff --git a/packages/database/src/Config/DatabaseDialect.php b/packages/database/src/Config/DatabaseDialect.php
index 157755b13c..0305bd14dc 100644
--- a/packages/database/src/Config/DatabaseDialect.php
+++ b/packages/database/src/Config/DatabaseDialect.php
@@ -24,8 +24,8 @@ public function tableNotFoundCode(): string
     public function quoteIdentifier(string $identifier): string
     {
         return match ($this) {
-            self::MYSQL, self::SQLITE => sprintf('`%s`', $identifier),
-            self::POSTGRESQL => sprintf('"%s"', $identifier),
+            self::MYSQL, self::SQLITE => sprintf('`%s`', str_replace('`', '``', $identifier)),
+            self::POSTGRESQL => sprintf('"%s"', str_replace('"', '""', $identifier)),
         };
     }
 
diff --git a/packages/database/tests/Config/DatabaseDialectTest.php b/packages/database/tests/Config/DatabaseDialectTest.php
new file mode 100644
index 0000000000..575327589e
--- /dev/null
+++ b/packages/database/tests/Config/DatabaseDialectTest.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tempest\Database\Tests\Config;
+
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestWith;
+use PHPUnit\Framework\TestCase;
+use Tempest\Database\Config\DatabaseDialect;
+
+/**
+ * @internal
+ */
+final class DatabaseDialectTest extends TestCase
+{
+    #[TestWith([DatabaseDialect::MYSQL, 'title', '`title`'])]
+    #[TestWith([DatabaseDialect::MYSQL, 'ti`tle', '`ti``tle`'])]
+    #[TestWith([DatabaseDialect::SQLITE, 'title', '`title`'])]
+    #[TestWith([DatabaseDialect::SQLITE, 'ti`tle', '`ti``tle`'])]
+    #[TestWith([DatabaseDialect::POSTGRESQL, 'title', '"title"'])]
+    #[TestWith([DatabaseDialect::POSTGRESQL, 'ti"tle', '"ti""tle"'])]
+    #[Test]
+    public function quote_identifier(DatabaseDialect $dialect, string $identifier, string $expected): void
+    {
+        $this->assertSame($expected, $dialect->quoteIdentifier($identifier));
+    }
+}