From: Christoph Haller <ch@rodos.fzk.de>
To: pgsql-interfaces@postgresql.org
Cc: frankie@ucr.com.hk
Subject: Re: Segmentation Fault
Date: Fri, 04 Apr 2003 09:44:51 +0200
Message-ID: <3E8D37F3.70006@rodos.fzk.de> (raw)
> >
> > The doc says:
> > If you want to include strings that have been received from a source
> > that is not trustworthy (for example, because a random user entered
> > them), you cannot directly include them in SQL queries for security
> > reasons. Instead, you have to quote special characters that are
> > otherwise interpreted by the SQL parser.
>
> hmm.., I did this on purpose. Because I want to grab SQL commands
> I previously stored in a table from one database, then reformat them
> and store them into another database.
> E.g. the reformatted string looks like:
> INSERT INTO tableOnAnotherDB(sqlCMD) values('delete from test where
> name=''\\\\''');
>
Ok, I see. I didn't think of that possibility. You are right.
Regards, Christoph
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: ch@rodos.fzk.de, frankie@ucr.com.hk
Subject: Re: Segmentation Fault
In-Reply-To: <3E8D37F3.70006@rodos.fzk.de>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox