Received: from sss2.sss.pgh.pa.us (sss.pgh.pa.us [209.114.166.2]) by hub.org (8.9.3/8.9.3) with ESMTP id NAA36724 for ; Tue, 4 Jan 2000 13:13:05 -0500 (EST) (envelope-from tgl@sss.pgh.pa.us) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss2.sss.pgh.pa.us (8.9.3/8.9.3) with ESMTP id NAA13970; Tue, 4 Jan 2000 13:12:59 -0500 (EST) To: The Hermit Hacker cc: pgsql-interfaces@postgreSQL.org Subject: Re: [INTERFACES] escaping characters ... In-reply-to: References: Comments: In-reply-to The Hermit Hacker message dated "Tue, 04 Jan 2000 13:45:59 -0400" Date: Tue, 04 Jan 2000 13:12:58 -0500 Message-ID: <13967.947009578@sss.pgh.pa.us> From: Tom Lane The Hermit Hacker writes: > MySQl has 'mysql_escape_string' in it's client library. Does Pg have > something like that? libpq doesn't provide any such function --- perhaps it should, but on the other hand the amount of code involved is pretty tiny, and issues like memory allocation/freeing would complicate the definition of the function. > if not, what should be escaped? When generating quoted strings for use in SQL commands, you should prefix single-quote (') and backslash (\) characters with a backslash. I think that's all. COPY IN/OUT data has a different set of rules. There, you can but don't have to backslash single quotes. You do need to convert returns and tabs into \n and \t, and of course backslash itself must be doubled. (If you are using some other character than tab as the field delimiter, then it'd need backslashing instead.) Data returned by libpq after a SELECT is not quoted at all. regards, tom lane