[2.6.0] Got DB connection error after update

[makersm]

Hi, I'm using DB connection using .env file.
.env file looks like below :

DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=homestead_h
DB_USERNAME=homestead
DB_PASSWORD=secret!@#

and I got Access denied for user ~~ error.
After revert phpdotenv's version 2.6.0 to 2.5.2, everything works fine.

[zhouzyc]

I also have a connection error. After updating, the password has a # number.

[zhouzyc]

Hi, I'm using DB connection using .env file.
.env file looks like below :

DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=homestead_h
DB_USERNAME=homestead
DB_PASSWORD=secret!@#

and I got Access denied for user ~~ error.
After revert phpdotenv's version 2.6.0 to 2.5.2, everything works fine.
With the new configuration file：
DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=homestead_h
DB_USERNAME=homestead
DB_PASSWORD=”secret!@#“

[robtesch]

Same issue with Laravel project. Tried every possible combination of quotes and no quotes. My password has a # in it if that's any help.

[zhouzyc]

@robtesch
have a try
DB_PASSWORD=secret!@# ->DB_PASSWORD=”secret!@#“

[erikscheepers]

Same error here, also a # in the password. Putting the password between quotes fixes the issue. My password looks like se#cret (no # at the end).

[GrahamCampbell]

Thanks for the report. It looks like we're missing some tests.

[GrahamCampbell]

The new version is parsing the hash as a comment.

[GrahamCampbell]

I'm prepping a fix now.

[GrahamCampbell]

Please let me know if #338 fixes your issue. :)

[GrahamCampbell]

I've released v2.6.1 with the parser fixes.

[robtesch]

@GrahamCampbell thanks very much, that fixed it. Out of interest, for future (v3+) how should we do it? Do we need to escape some chars?

[GrahamCampbell]

The three differences are:

1. For unquoted strings, as soon as there's a hash, it's treated as a comment start.
2. We're being stricter about invalid escape sequences within quoted strings.
3. We're no longer trimming the parsed values of quoted strings.

input value	2.5.2	2.6.1	3.3.1
foo#bar	foo#bar	foo#bar	foo
foo # bar	foo	foo	foo
"iiiiviiiixiiiiviiii\n"	silent failure	iiiviiiixiiiiviiii\n	fails with invalid escape sequence exception
"iiiiviiiixiiiiviiii\\n"	iiiiviiiixiiiiviiii\n	iiiiviiiixiiiiviiii\n	iiiiviiiixiiiiviiii\n
"foo\"bar"	foo"bar	foo"bar	foo"bar
" foo "	foo with whitespace trimmed	foo with whitespace trimmed	foo with 2 spaces in front and one after

In double quoted strings, double quotes and backslashes need escaping with a backslash, and in single quoted strings, single quote and backslashes need escaping with a backslash. In v2.5.2, forgetting an escape can lead to odd results due to the regex running out of stack, but this was fixed in 2.6 and 3.3, with 2.6 allowing you to continue after an unescaped backslash, but 3.3 not.

[robtesch]

Good stuff, so just to confirm, even for v3.3+, if the input is:
"p455w0rd123#"
it will come out as:
p455w0rd123#

No need to escape anything since it's in double quotes and does not contain any double quotes or backslashes.