[CRITICAL] SQL injection vector when manually quoting values for sqlsrv extension, using null byte

PKSA-nmjm-qdd3-rzhy CVE-2014-8089 GHSA-qh9w-r7g5-q939

Affected package: zendframework/zend-db

Affected version: >=2.0.0,<2.0.99|>=2.1.0,<2.1.99|>=2.2.0,<2.2.8|>=2.3.0,<2.3.3

Reported by:
GitHub, FriendsOfPHP/security-advisories