X-Original-To: pgsql-bugs-postgresql.org@localhost.postgresql.org Received: from localhost (unknown [64.117.224.130]) by svr1.postgresql.org (Postfix) with ESMTP id D174BD1B4E3 for ; Tue, 7 Oct 2003 21:14:00 +0000 (GMT) Received: from svr1.postgresql.org ([64.117.224.193]) by localhost (neptune.hub.org [64.117.224.130]) (amavisd-new, port 10024) with ESMTP id 98387-07 for ; Tue, 7 Oct 2003 18:13:13 -0300 (ADT) Received: from altair.kickinit.net (altair.kickinit.net [209.223.234.6]) by svr1.postgresql.org (Postfix) with ESMTP id 899BCD1B50F for ; Tue, 7 Oct 2003 18:13:10 -0300 (ADT) Received: from altair.kickinit.net (altair.kickinit.net [127.0.0.1]) by altair.kickinit.net (8.12.10/8.12.10) with ESMTP id h97LCvMj026698 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 7 Oct 2003 16:12:57 -0500 Received: from localhost (brw@localhost) by altair.kickinit.net (8.12.10/8.12.8/Submit) with ESMTP id h97LCvh5026695 for ; Tue, 7 Oct 2003 16:12:57 -0500 Date: Tue, 7 Oct 2003 16:12:57 -0500 (CDT) From: "Branden R. Williams" X-X-Sender: brw@altair.kickinit.net To: pgsql-bugs@postgresql.org Subject: Bug Report Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Virus-Scanned: by amavisd-new at postgresql.org X-Archive-Number: 200310/60 X-Sequence-Number: 6909 ============================================================================ POSTGRESQL BUG REPORT TEMPLATE ============================================================================ Your name : Branden R. Williams Your email address : brw@brw.net System Configuration --------------------- Architecture (example: Intel Pentium) : Intel Pentium Operating System (example: Linux 2.0.26 ELF) : Linux 2.4.18 ELF PostgreSQL version (example: PostgreSQL-7.3.4): PostgreSQL-7.3.4 Compiler used (example: gcc 2.95.2) : Your RPM, RH 8. Please enter a FULL description of your problem: ------------------------------------------------ When using the replace() function, it appears that some of the output is filtered through a printf variant. If you have legitimate db characters that are also printf flags, it causes big problems. Please describe a way to repeat the problem. Please try to provide a concise reproducible example, if at all possible: ---------------------------------------------------------------------- Place this data inside one field in a db... /estore/purchase_licenses.asp?numberoflicenses='UNION'&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='UNION'&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='%22&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='%22&ID=1& = /estore/purchase_licenses.asp?numberoflicenses=9%2c+9%2c+9&ID=1& = /estore/purchase_licenses.asp?numberoflicenses=9%2c+9%2c+9&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='bad_bad_value&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='bad_bad_value&ID=1& = /estore/purchase_licenses.asp?numberoflicenses=bad_bad_value'&ID=1& = /estore/purchase_licenses.asp?numberoflicenses=bad_bad_value'&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='+OR+'&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='+OR+'&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='WHERE&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='WHERE&ID=1& = /estore/purchase_licenses.asp?numberoflicenses=%3B&ID=1& = /estore/purchase_licenses.asp?numberoflicenses=%3B&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='OR&ID=1& = /estore/purchase_licenses.asp?numberoflicenses='OR&ID=1& = Now pretend that you want to filter out various characters, including the % because %2c is something that printf uses. In my app, I use printf to parse data that comes from the database, so I need to fix this. Doing a nested replace, select the field out using the following commands... replace(replace(replace(reportresults.data, chr(92), '\'), chr(37), '%'), chr(9), '') as data Look at the results and you will notice the select does not look like it does if you do not filter at all (or have the replaced characters in there on some lines). If you know how this problem might be fixed, list the solution below: --------------------------------------------------------------------- You will probably have to filter out any % so that printf does not try to interpret it.