- CVE-2025-1735: ext/pgsql and ext/pdo_pgsql ignored escaping errors (GHSA-hrwm-9436-5mv3); every PQescapeStringConn() call passed NULL as the error out-param, so when libpq rejected a string as invalid for the connection encoding the caller went on to use the unescaped or half-escaped buffer; pass an error out-param at every call site and fail the operation instead - pg_escape_string() warns and returns false, php_pgsql_meta_data() returns FAILURE, php_pgsql_convert() reports the field and skips it, and pdo_pgsql's quoter returns failure so PDO raises an error; also check PQescapeIdentifier() and PQescapeByteaConn() for NULL, which makes build_tablename() return SUCCESS/FAILURE to its five callers and pg_escape_bytea() warn and return false