Re: Control characters in sql statements close db connection

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Barry Lind <blind(at)xythos(dot)com>
Cc: "Mushran, Vrinda" <Vrinda(at)netopia(dot)com>, "'pgsql-jdbc(at)postgresql(dot)org'" <pgsql-jdbc(at)postgresql(dot)org>
Subject: Re: Control characters in sql statements close db connection
Date: 2003-01-17 18:25:32
Message-ID: 13552.1042827932@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-jdbc

Barry Lind <blind(at)xythos(dot)com> writes:
> Yes I would say this is expected behavior. If you use the regular
> Statement object it is your responsibility to properly quote and escape
> the data. However if you use a PreparedStatement then the driver
> handles it for you.

> So you would issue the following via a PreparedStatement:
> SELECT * FROM NEB_IPSNMPDEVICES WHERE NEB_IPSNMPDevices.PHY_ADDRESS = ?
> and then do a stmt.setString(1,"'^(at)`^]:u'");

But there is no escape for a \0, except in the limited context of
BYTEA values. It'd probably be better for the driver to reject 'em.

Does JDBC understand about BYTEA fields? If so, it could generate the
correct escape when filling a parameter for a BYTEA value, and fail
otherwise.

regards, tom lane

In response to

Responses

Browse pgsql-jdbc by date

  From Date Subject
Next Message Barry Lind 2003-01-17 20:49:58 Re: Control characters in sql statements close db connection
Previous Message Joel Hock 2003-01-17 18:09:45 insertRow and updateable resultset