diff --git a/src/ORM/Connect/PDOConnector.php b/src/ORM/Connect/PDOConnector.php
index 7f4c5ff3e..bb1637d65 100644
--- a/src/ORM/Connect/PDOConnector.php
+++ b/src/ORM/Connect/PDOConnector.php
@@ -292,7 +292,7 @@ class PDOConnector extends DBConnector implements TransactionManager
 
     public function quoteString($value)
     {
-        return $this->pdoConnection->quote($value);
+        return $this->pdoConnection->quote($value ?? '');
     }
 
     /**
diff --git a/src/Security/Security.php b/src/Security/Security.php
index d58c6d715..5f82d8202 100644
--- a/src/Security/Security.php
+++ b/src/Security/Security.php
@@ -948,7 +948,7 @@ class Security extends Controller implements TemplateGlobalProvider
         static::clearSessionMessage();
 
         // Ensure title is present - in case getResponseController() didn't return a page controller
-        $fragments = array_merge($fragments, ['Title' => $title]);
+        $fragments = array_merge(['Title' => $title], $fragments);
         if ($message) {
             $messageResult = [
                 'Content'     => DBField::create_field('HTMLFragment', $message),