From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alvaro Herrera <alvherre@alvh.no-ip.org>
cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>, takaram71@gmail.com,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17767: psql: tab-completion causes warnings when
 standard_conforming_strings = off
In-reply-to: <20230206154300.ljxzsrulodicqqcd@alvherre.pgsql>
References: <20230206154300.ljxzsrulodicqqcd@alvherre.pgsql>
Comments: In-reply-to Alvaro Herrera <alvherre@alvh.no-ip.org>
	message dated "Mon, 06 Feb 2023 16:43:00 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2666614.1675698630.1@sss.pgh.pa.us>
Date: Mon, 06 Feb 2023 10:50:30 -0500
Message-ID: <2666615.1675698630@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2666615.1675698630%40sss.pgh.pa.us>
Precedence: bulk

Alvaro Herrera <alvherre@alvh.no-ip.org> writes:
> On 2023-Feb-06, Tom Lane wrote:
>> I think removing standard_conforming_strings = off might be a
>> bridge too far, even yet.  Or were you speaking of removing
>> escape_string_warning?  I could get behind that perhaps.
>> Making it default to off could be an even easier sell.

> I was thinking we'd remove them together.  Anybody who is running
> standard_conforming_strings=off will need the warning so that they can
> find the places they need to touch in order to migrate.  Keeping the
> ability to run nonstandard strings but without the ability to have the
> warnings would be dangerous, because then there's no easy way to
> upgrade.

Yeah, that's true.  So then the question is do we have any desire
to kill off standard_conforming_strings=off altogether?

You could certainly make an argument that doing so would be a net
security improvement, because it's likely that by now there are a
ton of applications that aren't careful with backslashes and will
have SQL-injection hazards if run under standard_conforming_strings=off.
Whether that argument will placate the people who don't want to
change their existing s_c_s=off-dependent apps, I dunno.

> (I agree BTW with the idea that running psql with non-standard strings
> and the warnings enabled is not something that we need to support
> specifically.)

Yeah, just changing the e_s_w default to "off" might be easiest.

			regards, tom lane