Skip site navigation (1) Skip section navigation (2)

Re: PQescapeIdentifier

From: Christopher Kings-Lynne <chris(dot)kings-lynne(at)calorieking(dot)com>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: PQescapeIdentifier
Date: 2006-05-31 03:15:58
Message-ID: 447D0A6E.4000903@calorieking.com (view raw or flat)
Thread:
Lists: pgsql-hackers
> Christopher Kings-Lynne <chris(dot)kings-lynne(at)calorieking(dot)com> writes:
>> Here's a question. I wish to add a function to libpq to escape 
>> PostgreSQL identifiers.  Will this function be subject to the same 
>> security/encoding issues as PQescapeString?
> 
> Is this of any general-purpose use?  How many apps are really prepared
> to let an untrusted user dictate which columns are selected/compared?

phpPgAdmin has use for it, I assume pgAdmin would as well.  As does 
PHP's PostgreSQL interface, etc.  The PHP sites I work on in my job have 
some functions to automatically build queries (eg. insert queries), 
which technically need to escape column names.

It seems nice from my point of view as "completeness", and will help in 
the case when we ever change identifier escaping, etc.  It might also 
encourage app writers to escape fields properly...I've seen too many 
places where they escape strings, but not fields...

However, I guess it's still a small minority of apps.

> But to answer your question, yes, I can certainly imagine
> encoding-related risks...

It's probably out of my league to code safely then I guess, unless it's 
basically the same coding as for PQescapeStringInternal...?

Chris



In response to

pgsql-hackers by date

Next:From: Christopher Kings-LynneDate: 2006-05-31 03:38:22
Subject: LinkedIn
Previous:From: Tom LaneDate: 2006-05-31 03:08:38
Subject: Re: PQescapeIdentifier

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group