Literal substitution is the direct replacement of one fixed text value with another, without interpreting the content as a pattern, expression, or template rule. In security-sensitive code, this can be safer than regex-driven or highly dynamic string handling because it reduces the number of ways attacker-controlled input can be misread or transformed.
In web applications, unsafe text processing often sits between user input and a SQL query, command, or configuration value. If that processing tries to be too flexible, special characters can change the meaning of the final output and create injection bugs. Literal substitution helps defensive code stay predictable: replace exactly what was intended, and nothing else. In Roundcube’s vulnerable query path, moving to literal substitution reflects this principle by making database query assembly less error-prone and easier to reason about during review.