From 9d71c1e0b60cd152a47528dbe514efc443fce920 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Thu, 20 Nov 2025 02:58:45 +0100
Subject: [PATCH 1/4] Fix GH-20528: Regression breaks mysql connexion using an
 IPv6 address enclosed in square brackets

---
 ext/mysqli/tests/mysqli_connect_port.phpt | 31 +++++++++++++++++++++++
 ext/mysqlnd/mysqlnd_connection.c          | 17 ++++++++++---
 2 files changed, 45 insertions(+), 3 deletions(-)
 create mode 100644 ext/mysqli/tests/mysqli_connect_port.phpt

diff --git a/ext/mysqli/tests/mysqli_connect_port.phpt b/ext/mysqli/tests/mysqli_connect_port.phpt
new file mode 100644
index 00000000000..cb7fd1d8d16
--- /dev/null
+++ b/ext/mysqli/tests/mysqli_connect_port.phpt
@@ -0,0 +1,31 @@
+--TEST--
+mysqli_connect() with port in host
+--EXTENSIONS--
+mysqli
+--SKIPIF--
+<?php
+require_once 'skipifconnectfailure.inc';
+?>
+--FILE--
+<?php
+    require_once 'connect.inc';
+
+	// using port / host arguments
+    if (!$link = mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
+        printf("Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+            $host, $user, $db, $port, $socket);
+	}
+
+    mysqli_close($link);
+
+	// using port in host
+    if (!$link = mysqli_connect("$host:$port", $user, $passwd, $db, "1$port", $socket)) {
+        printf("Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+            "$host:$port", $user, $db, "1$port", $socket);
+	}
+
+    mysqli_close($link);
+?>
+Done
+--EXPECTF--
+Done
diff --git a/ext/mysqlnd/mysqlnd_connection.c b/ext/mysqlnd/mysqlnd_connection.c
index d8e7304e966..8268034e8b7 100644
--- a/ext/mysqlnd/mysqlnd_connection.c
+++ b/ext/mysqlnd/mysqlnd_connection.c
@@ -553,13 +553,24 @@ MYSQLND_METHOD(mysqlnd_conn_data, get_scheme)(MYSQLND_CONN_DATA * conn, MYSQLND_
 			port = 3306;
 		}
 
-		/* ipv6 addresses are in the format [address]:port */
 		if (hostname.s[0] != '[' && mysqlnd_fast_is_ipv6_address(hostname.s)) {
+			/* IPv6 without square brackets so without port */
 			transport.l = mnd_sprintf(&transport.s, 0, "tcp://[%s]:%u", hostname.s, port);
 		} else {
-			/* Not ipv6, but could already contain a port number, in which case we should not add an extra port.
+			char *p;
+
+			/* IPv6 addresses are in the format [address]:port */
+			if (hostname.s[0] == '[') { /* IPv6 */
+				p = strchr(hostname.s, ']');
+				if (p && p[1] != ':') {
+					p = NULL;
+				}
+			} else { /* IPv4 or name */
+				p = strchr(hostname.s, ':');
+			}
+			/* Could already contain a port number, in which case we should not add an extra port.
 			 * See GH-8978. In a port doubling scenario, the first port would be used so we do the same to keep BC. */
-			if (strchr(hostname.s, ':')) {
+			if (p) {
 				/* TODO: Ideally we should be able to get rid of this workaround in the future. */
 				transport.l = mnd_sprintf(&transport.s, 0, "tcp://%s", hostname.s);
 			} else {

From 769f31986798f322d98a492abb83bfb7f3f28747 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Fri, 21 Nov 2025 09:19:38 +0100
Subject: [PATCH 2/4] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 2ed91237253..ad27dba473a 100644
--- a/NEWS
+++ b/NEWS
@@ -32,6 +32,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-20492 (mbstring compile warning due to non-strings).
     (ndossche)
 
+- MySQLnd:
+  . Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address
+    enclosed in square brackets). (Remi)
+
 - Opcache:
   . Fixed bug GH-20329 (opcache.file_cache broken with full interned string
     buffer). (Arnaud)

From 74c4510da92b92bd9323edcfe88bc18835a608c5 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Fri, 21 Nov 2025 09:20:22 +0100
Subject: [PATCH 3/4] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 06aa7adcc02..6e03a774df2 100644
--- a/NEWS
+++ b/NEWS
@@ -36,6 +36,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-20492 (mbstring compile warning due to non-strings).
     (ndossche)
 
+- MySQLnd:
+  . Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address
+    enclosed in square brackets). (Remi)
+
 - Opcache:
   . Fixed bug GH-20329 (opcache.file_cache broken with full interned string
     buffer). (Arnaud)

From e2219488ba31b0e018a945e4b7d0b28b53716f2d Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Fri, 21 Nov 2025 09:21:03 +0100
Subject: [PATCH 4/4] NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 253e597cf2d..b6efe0d85e5 100644
--- a/NEWS
+++ b/NEWS
@@ -32,6 +32,10 @@ PHP                                                                        NEWS
   . Fix some deprecations on newer libxml versions regarding input
     buffer/parser handling. (ndossche)
 
+- MySQLnd:
+  . Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address
+    enclosed in square brackets). (Remi)
+
 - Opcache:
   . Fixed bug GH-20329 (opcache.file_cache broken with full interned string
     buffer). (Arnaud)