Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

When a connection uses a multi-byte character_set_client whose trail-byte range overlaps the ASCII escape character 0x5C (), namely big5, gbk, sjis, cp932, and gb18030, the connector's byte-wise escaping of Buffer parameters can be subverted into a SQL injection.

The escape routine inserts 0x5C before a quote (0x27) / backslash inside binary input. Over the wire, the server lexer runs its multi-byte-character recognition (my_ismbchar) before escape processing: if an attacker-controlled lead byte precedes the inserted 0x5C, the server consumes <lead><0x5C> as a single multi-byte character, "eating" the escape and leaving the following 0x27 as a bare, unescaped quote that terminates the string literal, allowing injected SQL.

This affects Buffer-typed parameters (the common path for binary data) escaped client-side under one of the listed charsets.