Message-ID: <3E8D37F3.70006@rodos.fzk.de>
Date: Fri, 04 Apr 2003 09:44:51 +0200
From: Christoph Haller <ch@rodos.fzk.de>
User-Agent: Mozilla/5.0 (X11; U; HP-UX 9000/780; en-US; rv:1.3) Gecko/20030321
MIME-Version: 1.0
To: pgsql-interfaces@postgresql.org
Cc: frankie@ucr.com.hk
Subject: Re: Segmentation Fault
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

 > >
 > > The doc says:
 > > If you want to include strings that have been received from a source
 > > that is not trustworthy (for example, because a random user entered
 > > them), you cannot directly include them in SQL queries for security
 > > reasons. Instead, you have to quote special characters that are
 > > otherwise interpreted by the SQL parser.
 >
 > hmm.., I did this on purpose. Because I want to grab SQL commands
 > I previously stored in a table from one database, then reformat them
 > and store them into another database.
 > E.g. the reformatted string looks like:
 > INSERT INTO tableOnAnotherDB(sqlCMD) values('delete from test where
 > name=''\\\\''');
 >
Ok, I see. I didn't think of that possibility. You are right.
Regards, Christoph