Escape values to avoid breaking them within single quotes

features/config-create.feature

@@ -155,3 +155,20 @@ Feature: Create a wp-config file
       """
       define( 'WPLANG', 'ja' );
       """
+
+  Scenario: Values are properly escaped to avoid creating invalid config files
+    Given an empty directory
+    And WP files
+
+    When I run `wp config create --skip-check --dbname=somedb --dbuser=someuser --dbpass="PasswordWith'SingleQuotes'"`
+    Then the wp-config.php file should contain:
+      """
+      define( 'DB_PASSWORD', 'PasswordWith\'SingleQuotes\'' )
+      """
+
+    When I run `wp config get DB_PASSWORD`
+    Then STDOUT should be:
+      """
+      PasswordWith'SingleQuotes'
+      """
+

src/Config_Command.php

@@ -165,10 +165,6 @@ public function create( $_, $assoc_args ) {
 			Utils\run_mysql_command( '/usr/bin/env mysql --no-defaults', $mysql_db_connection_args );
 		}
 
-		if ( Utils\get_flag_value( $assoc_args, 'extra-php' ) === true ) {
-			$assoc_args['extra-php'] = file_get_contents( 'php://stdin' );
-		}
-
 		if ( ! Utils\get_flag_value( $assoc_args, 'skip-salts' ) ) {
 			try {
 				$assoc_args['keys-and-salts']    = true;
@@ -195,6 +191,16 @@ public function create( $_, $assoc_args ) {
 			$assoc_args['add-wplang'] = false;
 		}
 
+		foreach ( $assoc_args as $key => $value ) {
+			$assoc_args[ $key ] = $this->escape_config_value( $key, $value );
+		}
+
+		// 'extra-php' from STDIN is retrieved after escaping to avoid breaking
+		// the PHP code.
+		if ( Utils\get_flag_value( $assoc_args, 'extra-php' ) === true ) {
+			$assoc_args['extra-php'] = file_get_contents( 'php://stdin' );
+		}
+
 		$command_root = Utils\phar_safe_path( dirname( __DIR__ ) );
 		$out          = Utils\mustache_render( "{$command_root}/templates/wp-config.mustache", $assoc_args );
 
@@ -1021,4 +1027,29 @@ private function print_dotenv( array $value ) {
 
 		WP_CLI::line( "{$name}={$variable_value}" );
 	}
+
+	/**
+	 * Escape a config value so it can be safely used within single quotes.
+	 *
+	 * @param string $key   Key into the arguments array.
+	 * @param mixed  $value Value to escape.
+	 * @return mixed Escaped value.
+	 */
+	private function escape_config_value( $key, $value ) {
+		// Skip 'extra-php', it mustn't be escaped.
+		if ( 'extra-php' === $key ) {
+			return $value;
+		}
+
+		// Skip 'keys-and-salts-alt' and assume they are safe.
+		if ( 'keys-and-salts-alt' === $key && ! empty( $value ) ) {
+			return $value;
+		}
+
+		if ( is_string( $value ) ) {
+			return addslashes( $value );
+		}
+
+		return $value;
+	}
 }