From: | Unprivileged user <nobody> |
---|---|
To: | pgsql-ports(at)postgresql(dot)org |
Subject: | Port Bug Report: parse error not detected on unterminated quote |
Date: | 1999-06-29 17:46:50 |
Message-ID: | 199906291746.NAA20468@hub.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-ports pgsql-sql |
============================================================================
POSTGRESQL BUG REPORT TEMPLATE
============================================================================
Your name : Kyle Bateman
Your email address : kyle(at)actarg(dot)com
Category : runtime: back-end: SQL
Severity : serious
Summary: parse error not detected on unterminated quote
System Configuration
--------------------
Operating System : Linux Redhat 5.2
PostgreSQL version : 6.5
Compiler used :
Hardware:
---------
Versions of other tools:
------------------------
Linux tao.actarg.com 2.0.36 #3 Tue Apr 6 14:20:35 MDT 1999 i686 unknown
--------------------------------------------------------------------------
Problem Description:
--------------------
If a single quote is left unmatched in the query, the parser
seems to throw away the rest of the line without detecting
an error.
If the quote appears before a where clause, the results can
be disasterous as the whole table might be deleted, updated,
etc.
--------------------------------------------------------------------------
Test Case:
----------
Enter a select like this:
select * from mytable where id = 1234;
You should get only one record.
Now put in an errant single quote:
select * from mytable' where id = 1234;
Now you get the whole table. This should really be a
syntax error of some kind.
If the query is a delete or an update, this can be a nasty
problem.
--------------------------------------------------------------------------
Solution:
---------
I suppose the parser should check at the end of the command
to see if any unterminated quoted material is still pending.
--------------------------------------------------------------------------
From | Date | Subject | |
---|---|---|---|
Next Message | Unprivileged user | 1999-06-29 18:24:26 | Port Bug Report: Can't create indicies on type "timestamp" |
Previous Message | Blinkov Igor | 1999-06-29 05:27:13 | PostrgeSQL 6.5, I have met a problem of automatic definition of my system |
From | Date | Subject | |
---|---|---|---|
Next Message | Hostmaster - Internet au Virtuel Inc. | 1999-06-29 20:00:56 | User defined functions through ODBC |
Previous Message | Tom Lane | 1999-06-28 23:32:07 | Re: [SQL] float4 |