fix: require AS keyword for function/subquery aliases in isIdentifierEscapeExempt to prevent SQL injection bypass

Author: gr8man

system/Database/BaseConnection.php

@@ -1440,7 +1440,7 @@ public function escapeIdentifier($item): string
     private function isIdentifierEscapeExempt(string $item): bool
     {
         $item = trim($item);
-        
+
         if ($item === '') {
             return false;
         }
@@ -1458,7 +1458,7 @@ private function isIdentifierEscapeExempt(string $item): bool
         // SQL functions or subqueries (e.g. MAX(id), (SELECT ...)) with an optional alias
         if (str_contains($item, '(')) {
             // Regex matching balanced parentheses (from start to end or with a safe alias)
-            if (preg_match('/^(?:[a-zA-Z0-9_.]+\s*)?(?P<parens>\((?:[^()]+|(?&parens))*\))(?:\s+(?:AS\s+)?(?:[a-zA-Z0-9_.]+|"[^"]*"|\'[^\']*\'|`[^`]*`))?$/is', $item)) {
+            if (preg_match('/^(?:[a-zA-Z0-9_.]+\s*)?(?P<parens>\((?:[^()]+|(?&parens))*\))(?:\s+AS\s+(?:[a-zA-Z0-9_.]+|"[^"]*"|\'[^\']*\'|`[^`]*`))?$/is', $item)) {
                 return true;
             }
         }

tests/system/Database/BaseConnectionTest.php

@@ -445,7 +445,7 @@ public static function provideProtectIdentifiers(): iterable
                 true,
                 true,
                 'COUNT(id) OR 1=1',
-                'COUNT(id) OR "1=1"',
+                '"COUNT(id) OR" "1=1"',
             ],
             'SQLi: Unbalanced parenthesis attack' => [
                 false,