[EFCore] Fix MySQL/MariaDB literal sanitization

src/OpenTelemetry.Instrumentation.EntityFrameworkCore/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+* Fixed query sanitization so that backslash-escaped quotes (`'a\'b'`) in
+  MySQL/MariaDB string literals and PostgreSQL dollar-quoted strings
+  (`$$...$$`) are correctly redacted.
+  ([#4986](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4986))
+
+* Fixed query sanitization so that MySQL/MariaDB double-quoted string
+  literals (`"..."`, valid when `ANSI_QUOTES` is disabled) are correctly
+  redacted.
+  ([#4986](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4986))
+
 ## 1.18.0-beta.1
 
 Released 2026-Aug-21

src/OpenTelemetry.Instrumentation.EntityFrameworkCore/Implementation/EntityFrameworkDiagnosticListener.cs

@@ -190,12 +190,18 @@ public override void OnEventWritten(string name, object? payload)
                                     // able to sanitize arbitrary commands for other query dialects.
                                     var sanitizeQuery = IsSqlLikeProvider(providerName);
 
+                                    // MySQL/MariaDB treat a backslash as a string-literal escape
+                                    // character by default, which the sanitizer must honor to avoid
+                                    // leaking literal content into the query text.
+                                    var useBackslashEscapes = IsBackslashEscapeProvider(providerName);
+
                                     DatabaseSemanticConventionHelper.ApplyConventionsForQueryText(
                                         activity,
                                         commandText,
                                         this.options.EmitOldAttributes,
                                         this.options.EmitNewAttributes,
-                                        sanitizeQuery);
+                                        sanitizeQuery,
+                                        useBackslashEscapes);
                                     break;
 
                                 case CommandType.TableDirect:
@@ -371,6 +377,21 @@ DbSystemNames.Sqlite or
         };
     }
 
+    internal static bool IsBackslashEscapeProvider(string? providerOrCommandName)
+    {
+        // MySQL and MariaDB (which use the MySQL providers) treat a backslash as a
+        // string-literal escape character unless the NO_BACKSLASH_ESCAPES SQL mode
+        // is enabled. The other supported engines follow the SQL standard where
+        // only a doubled quote ('') escapes a quote.
+        //
+        // This assumes the default (NO_BACKSLASH_ESCAPES disabled) behaviour: there is
+        // no way to detect the session SQL mode from the provider/command name alone,
+        // so if an application has enabled NO_BACKSLASH_ESCAPES the sanitizer will still
+        // treat '\' as an escape character for that connection.
+        (_, var dbSystemName) = GetDbSystemNames(providerOrCommandName);
+        return dbSystemName == DbSystemNames.Mysql;
+    }
+
     private void AddTag(Activity activity, (string Old, string New) attributes, string? value)
         => this.AddTag(activity, attributes, (value, value));
 

src/Shared/DatabaseSemanticConventionHelper.cs

@@ -69,14 +69,15 @@ public static void ApplyConventionsForQueryText(
         string? commandText,
         bool emitOldAttributes,
         bool emitNewAttributes,
-        bool sanitizeQuery = true)
+        bool sanitizeQuery = true,
+        bool useBackslashEscapes = false)
     {
         var queryText = commandText ?? string.Empty;
         var querySummary = string.Empty;
 
         if (sanitizeQuery)
         {
-            var sqlStatementInfo = SqlProcessor.GetSanitizedSql(commandText);
+            var sqlStatementInfo = SqlProcessor.GetSanitizedSql(commandText, useBackslashEscapes);
 
             queryText = sqlStatementInfo.SanitizedSql;
             querySummary = sqlStatementInfo.DbQuerySummary;