Index: sqlparse-0.4.4/sqlparse/filters/output.py
===================================================================
--- sqlparse-0.4.4.orig/sqlparse/filters/output.py
+++ sqlparse-0.4.4/sqlparse/filters/output.py
@@ -61,9 +61,11 @@ class OutputPythonFilter(OutputFilter):
                     yield sql.Token(T.Whitespace, after_lb)
                 continue
 
-            # Token has escape chars
-            elif "'" in token.value:
-                token.value = token.value.replace("'", "\\'")
+            # Escape backslashes before quotes so a backslash preceding a
+            # quote cannot break out of the generated string literal
+            # (GHSA-3496-9g83-7v6x).
+            else:
+                token.value = token.value.replace('\\', '\\\\').replace("'", "\\'")
 
             # Put the token
             yield sql.Token(T.Text, token.value)
@@ -110,9 +112,11 @@ class OutputPHPFilter(OutputFilter):
                     yield sql.Token(T.Whitespace, after_lb)
                 continue
 
-            # Token has escape chars
-            elif '"' in token.value:
-                token.value = token.value.replace('"', '\\"')
+            # Escape backslashes before quotes so a backslash preceding a
+            # quote cannot break out of the generated string literal
+            # (GHSA-3496-9g83-7v6x).
+            else:
+                token.value = token.value.replace('\\', '\\\\').replace('"', '\\"')
 
             # Put the token
             yield sql.Token(T.Text, token.value)
Index: sqlparse-0.4.4/tests/test_format.py
===================================================================
--- sqlparse-0.4.4.orig/tests/test_format.py
+++ sqlparse-0.4.4/tests/test_format.py
@@ -652,6 +652,22 @@ class TestOutputFormat:
             '$sql  = "select * ";',
             '$sql .= "from foo;";'])
 
+    def test_python_escapes_backslashes(self):
+        # GHSA-3496-9g83-7v6x: backslashes must be escaped before quotes so
+        # crafted SQL cannot break out of the generated Python string literal.
+        # SQL  select '\foo\'  -> each \ doubled, each ' escaped.
+        sql = "select '\\foo\\'"
+        f = lambda sql: sqlparse.format(sql, output_format='python')
+        assert f(sql) == "sql = 'select \\'\\\\foo\\\\\\''"
+
+    def test_php_escapes_backslashes(self):
+        # GHSA-3496-9g83-7v6x: PHP double-quoted output must escape backslashes
+        # before quotes; a backslash before a quote otherwise closes the string.
+        # SQL  select '\foo\'  -> each \ doubled (single quotes need no escaping).
+        sql = "select '\\foo\\'"
+        f = lambda sql: sqlparse.format(sql, output_format='php')
+        assert f(sql) == '$sql = "select \'\\\\foo\\\\\'";'
+
     def test_sql(self):
         # "sql" is an allowed option but has no effect
         sql = 'select * from foo;'