From: Richard Huxton <dev@archonet.com>
To: vernonw@gatewaytech.com
To: pgsql-sql@postgresql.org
Subject: Re: Special characters in SQL queries
Date: Wed, 12 Mar 2003 09:44:41 +0000
Message-ID: <200303120944.42009.dev@archonet.com> (raw)
In-Reply-To: <WTXVVUJGX3286IDIG87B697UXR87BA.3e6ea975@kimiko>
References: <WTXVVUJGX3286IDIG87B697UXR87BA.3e6ea975@kimiko>
On Wednesday 12 Mar 2003 3:28 am, Vernon Wu wrote:
> Thank Christoph for your information.
>
> I don't program in C at all, but Java. Although I can make a way to call
> the C library function from Java, it isn't suitable solution, I believe.
>
> I only desire to find out all the type of characters at the present time so
> that I can strip out any potential problem sources in text. Who know what
> characters a user will enter.
Don't do Java myself, but I can't believe the JDBC (or whatever) classes don't
do this for you. In any case, you can look at the code for the C function -
it should be fairly obvious what characters it's working on.
If you do want to write your own, it's best not to strip certain characters,
but rather to list those you will allow through. That way if you miss
something it's a bug report rather than a security hole.
--
Richard Huxton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: dev@archonet.com, vernonw@gatewaytech.com
Subject: Re: Special characters in SQL queries
In-Reply-To: <200303120944.42009.dev@archonet.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox