I was working on porting a security mechanism to Joomla, and figured out that
https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/database/driver.php#L1590
has a terrible vulnerability.

Joomla allows the developer to use #__ in the sql query as a placeholder for table prefix, and later tries to replace this with the actual prefix (before submitting the query to db).

Now, since #__ might appear in the rest of the query, specially inside strings, the replacePrefix function tries to quickly lex the query, and ignore #__ if it appears inside a string.

The issue is that lexing a SQL query is not that simple and straightforward, and one can easily use this to leak table prefix and break scope in the queries.

For example, the following query will become:

SELECT * FROM #__content WHERE 1>'#__abc'

SELECT * FROM ykl0e_content WHERE 1>'#__abc'

But this query will break the lexer easily:

SELECT * FROM #__content WHERE 1>/* ' */ '#__abc'

SELECT * FROM ykl0e_content WHERE 1>/* ' */ 'ykl0e_abc'