Fix SQL injection in hasDatabase() by quoting database name in adapters

src/Phinx/Db/Adapter/MysqlAdapter.php

@@ -1419,8 +1419,8 @@ public function hasDatabase(string $name): bool
     {
         $rows = $this->fetchAll(
             sprintf(
-                'SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = \'%s\'',
-                $name,
+                'SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = %s',
+                $this->getConnection()->quote($name),
             ),
         );
 

src/Phinx/Db/Adapter/PostgresAdapter.php

@@ -1206,7 +1206,7 @@ public function createDatabase(string $name, array $options = []): void
      */
     public function hasDatabase(string $name): bool
     {
-        $sql = sprintf("SELECT count(*) FROM pg_database WHERE datname = '%s'", $name);
+        $sql = sprintf('SELECT count(*) FROM pg_database WHERE datname = %s', $this->getConnection()->quote($name));
         $result = $this->fetchRow($sql);
 
         return $result['count'] > 0;

src/Phinx/Db/Adapter/SqlServerAdapter.php

@@ -1198,8 +1198,8 @@ public function hasDatabase(string $name): bool
         /** @var array<string, mixed> $result */
         $result = $this->fetchRow(
             sprintf(
-                "SELECT count(*) as [count] FROM master.dbo.sysdatabases WHERE [name] = '%s'",
-                $name,
+                'SELECT count(*) as [count] FROM master.dbo.sysdatabases WHERE [name] = %s',
+                $this->getConnection()->quote($name),
             ),
         );
 

tests/Phinx/Db/Adapter/MysqlAdapterTest.php

@@ -2030,6 +2030,11 @@ public function testHasDatabase()
         $this->assertTrue($this->adapter->hasDatabase(MYSQL_DB_CONFIG['name']));
     }
 
+    public function testHasDatabaseWithSingleQuoteInName()
+    {
+        $this->assertFalse($this->adapter->hasDatabase("fake'database'name"));
+    }
+
     public function testDropDatabase()
     {
         $this->assertFalse($this->adapter->hasDatabase('phinx_temp_database'));

tests/Phinx/Db/Adapter/PostgresAdapterTest.php

@@ -1949,6 +1949,11 @@ public function testHasDatabase()
         $this->assertTrue($this->adapter->hasDatabase(PGSQL_DB_CONFIG['name']));
     }
 
+    public function testHasDatabaseWithSingleQuoteInName()
+    {
+        $this->assertFalse($this->adapter->hasDatabase("fake'database'name"));
+    }
+
     public function testDropDatabase()
     {
         $this->assertFalse($this->adapter->hasDatabase('phinx_temp_database'));

tests/Phinx/Db/Adapter/SqlServerAdapterTest.php

@@ -1184,6 +1184,11 @@ public function testHasDatabase()
         $this->assertTrue($this->adapter->hasDatabase(SQLSRV_DB_CONFIG['name']));
     }
 
+    public function testHasDatabaseWithSingleQuoteInName()
+    {
+        $this->assertFalse($this->adapter->hasDatabase("fake'database'name"));
+    }
+
     public function testDropDatabase()
     {
         $this->assertFalse($this->adapter->hasDatabase('phinx_temp_database'));