From: Tom Lane <tgl@sss.pgh.pa.us>
To: Phillip Diffley <phillip6402@gmail.com>
cc: pgsql-general@postgresql.org
Subject: Re: Stably escaping an identifier
In-reply-to: <CAGAwPgQ+rhRaiPyrjG2DZhEgtYxRnsAa6jZYq2FdHu8Se+YWdg@mail.gmail.com>
References: <CAGAwPgQ+rhRaiPyrjG2DZhEgtYxRnsAa6jZYq2FdHu8Se+YWdg@mail.gmail.com>
Comments: In-reply-to Phillip Diffley <phillip6402@gmail.com>
	message dated "Sun, 15 Jun 2025 21:55:10 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <310037.1750018284.1@sss.pgh.pa.us>
Date: Sun, 15 Jun 2025 16:11:24 -0400
Message-ID: <310038.1750018284@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/310038.1750018284%40sss.pgh.pa.us>
Precedence: bulk

Phillip Diffley <phillip6402@gmail.com> writes:
> Is there a reliable way to determine if an identifier has already been
> escaped, or alternatively is there a function that will stably escape an
> identifier such that the identifier will not change if the function is
> called repeatedly?

This is impossible in general, because you can't know if the
double-quotes are meant to be part of the identifier value.

My advice here would be to flat-out reject input identifiers that
contain double quotes.  I'd suggest banning newlines too while
at it, as those are known to create security issues in some
contexts.

			regards, tom lane