[Quentak]

Thanks for this link.

How do you get the null byte into the string? Is it through casting blob to string? The way I have encountered this is when using the C API in which string arguments for prepared statements are passed as char pointers. If those contain the null byte then the string is cut off.

Allowing null characters and then mishandling them is worse than not allowing them.