Authenticated SQL injection via escape-then-truncate

SQL injection in phpMyFAQ before 4.1.7 allows remote authenticated users to read database content via glossary endpoints. GlossaryRepository::create and GlossaryRepository::update escape the item field, truncate the escaped result to 254 characters, and then interpolate it into a quoted SQL string, so a 253-character value ending in a single quote leaves a dangling backslash that consumes the next quote and turns the definition field into attacker-controlled SQL. Reachability requires a valid account with addglossary or editglossary permission, and the published proof of concept demonstrates direct disclosure of user, configuration, and password-hash data rather than a service interrupt.