From ebac48183bf71c2f85491e71b9e9e8f382eb45cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maximilian=20Kr=C3=B6g?= <maximilian.kroeg@geocept.com>
Date: Wed, 18 Mar 2026 15:11:24 +0100
Subject: [PATCH] Fix adding user with single quote in password
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Maximilian Krög <maximilian.kroeg@geocept.com>
---
 libraries/classes/Server/Privileges.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/classes/Server/Privileges.php b/libraries/classes/Server/Privileges.php
index 67c7cca9c0..301b8fd705 100644
--- a/libraries/classes/Server/Privileges.php
+++ b/libraries/classes/Server/Privileges.php
@@ -3554,7 +3554,7 @@ class Privileges
                     $hashedPassword = $_POST['pma_pw'];
                 }
 
-                $createUserReal = sprintf($createUserStmt, $hashedPassword);
+                $createUserReal = sprintf($createUserStmt, $this->dbi->escapeString($hashedPassword));
                 $createUserShow = sprintf($createUserStmt, '***');
             }
         } else {