MIME-Version: 1.0
References: <CAGAwPgQ+rhRaiPyrjG2DZhEgtYxRnsAa6jZYq2FdHu8Se+YWdg@mail.gmail.com>
 <310038.1750018284@sss.pgh.pa.us>
In-Reply-To: <310038.1750018284@sss.pgh.pa.us>
From: Phillip Diffley <phillip6402@gmail.com>
Date: Tue, 17 Jun 2025 11:49:15 +0200
Message-ID: <CAGAwPgSOdaZo7G0q7+mbRRQzbccBiMTAXvL-devxpGvS0PmkRQ@mail.gmail.com>
Subject: Re: Stably escaping an identifier
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-general@postgresql.org
Content-Type: multipart/alternative; boundary="00000000000094da3b0637c16dfe"
Archived-At: <https://www.postgresql.org/message-id/CAGAwPgSOdaZo7G0q7%2BmbRRQzbccBiMTAXvL-devxpGvS0PmkRQ%40mail.gmail.com>
Precedence: bulk

--00000000000094da3b0637c16dfe
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks!

On Sun, Jun 15, 2025 at 10:11=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote=
:

> Phillip Diffley <phillip6402@gmail.com> writes:
> > Is there a reliable way to determine if an identifier has already been
> > escaped, or alternatively is there a function that will stably escape a=
n
> > identifier such that the identifier will not change if the function is
> > called repeatedly?
>
> This is impossible in general, because you can't know if the
> double-quotes are meant to be part of the identifier value.
>
> My advice here would be to flat-out reject input identifiers that
> contain double quotes.  I'd suggest banning newlines too while
> at it, as those are known to create security issues in some
> contexts.
>
>                         regards, tom lane
>

--00000000000094da3b0637c16dfe
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks!</div><br><div class=3D"gmail_quote gmail_quote_con=
tainer"><div dir=3D"ltr" class=3D"gmail_attr">On Sun, Jun 15, 2025 at 10:11=
=E2=80=AFPM Tom Lane &lt;<a href=3D"mailto:tgl@sss.pgh.pa.us">tgl@sss.pgh.p=
a.us</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1=
ex">Phillip Diffley &lt;<a href=3D"mailto:phillip6402@gmail.com" target=3D"=
_blank">phillip6402@gmail.com</a>&gt; writes:<br>
&gt; Is there a reliable way to determine if an identifier has already been=
<br>
&gt; escaped, or alternatively is there a function that will stably escape =
an<br>
&gt; identifier such that the identifier will not change if the function is=
<br>
&gt; called repeatedly?<br>
<br>
This is impossible in general, because you can&#39;t know if the<br>
double-quotes are meant to be part of the identifier value.<br>
<br>
My advice here would be to flat-out reject input identifiers that<br>
contain double quotes.=C2=A0 I&#39;d suggest banning newlines too while<br>
at it, as those are known to create security issues in some<br>
contexts.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 regards, tom lane<br>
</blockquote></div>

--00000000000094da3b0637c16dfe--