Port Bug Report: parse error not detected on unterminated quote

From: Unprivileged user <nobody>
To: pgsql-ports(at)postgresql(dot)org
Subject: Port Bug Report: parse error not detected on unterminated quote
Date: 1999-06-29 17:46:50
Message-ID: 199906291746.NAA20468@hub.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-ports pgsql-sql


============================================================================
POSTGRESQL BUG REPORT TEMPLATE
============================================================================

Your name : Kyle Bateman
Your email address : kyle(at)actarg(dot)com

Category : runtime: back-end: SQL
Severity : serious

Summary: parse error not detected on unterminated quote

System Configuration
--------------------
Operating System : Linux Redhat 5.2

PostgreSQL version : 6.5

Compiler used :

Hardware:
---------

Versions of other tools:
------------------------
Linux tao.actarg.com 2.0.36 #3 Tue Apr 6 14:20:35 MDT 1999 i686 unknown

--------------------------------------------------------------------------

Problem Description:
--------------------
If a single quote is left unmatched in the query, the parser
seems to throw away the rest of the line without detecting
an error.

If the quote appears before a where clause, the results can
be disasterous as the whole table might be deleted, updated,
etc.

--------------------------------------------------------------------------

Test Case:
----------
Enter a select like this:
select * from mytable where id = 1234;
You should get only one record.

Now put in an errant single quote:
select * from mytable' where id = 1234;
Now you get the whole table. This should really be a
syntax error of some kind.

If the query is a delete or an update, this can be a nasty
problem.

--------------------------------------------------------------------------

Solution:
---------
I suppose the parser should check at the end of the command
to see if any unterminated quoted material is still pending.

--------------------------------------------------------------------------

Responses

Browse pgsql-ports by date

  From Date Subject
Next Message Unprivileged user 1999-06-29 18:24:26 Port Bug Report: Can't create indicies on type "timestamp"
Previous Message Blinkov Igor 1999-06-29 05:27:13 PostrgeSQL 6.5, I have met a problem of automatic definition of my system

Browse pgsql-sql by date

  From Date Subject
Next Message Hostmaster - Internet au Virtuel Inc. 1999-06-29 20:00:56 User defined functions through ODBC
Previous Message Tom Lane 1999-06-28 23:32:07 Re: [SQL] float4