Content-Type: text/plain;
  charset="iso-8859-2"
From: Richard Huxton <dev@archonet.com>
Organization: Archonet Ltd
To: vernonw@gatewaytech.com, pgsql-sql@postgresql.org
Subject: Re: Special characters in SQL queries
Date: Wed, 12 Mar 2003 09:44:41 +0000
User-Agent: KMail/1.4.3
References: <WTXVVUJGX3286IDIG87B697UXR87BA.3e6ea975@kimiko>
In-Reply-To: <WTXVVUJGX3286IDIG87B697UXR87BA.3e6ea975@kimiko>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Message-Id: <200303120944.42009.dev@archonet.com>

On Wednesday 12 Mar 2003 3:28 am, Vernon Wu wrote:
> Thank Christoph for your information.
>
> I don't program in C at all, but Java. Although I can make a way to call
> the C library function from Java, it isn't suitable solution, I believe.
>
> I only desire to find out all the type of characters at the present time =
so
> that I can strip out any potential problem sources in text. Who know what
> characters a user will enter.

Don't do Java myself, but I can't believe the JDBC (or whatever) classes do=
n't=20
do this for you. In any case, you can look at the code for the C function -=
=20
it should be fairly obvious what characters it's working on.

If you do want to write your own, it's best not to strip certain characters=
,=20
but rather to list those you will allow through. That way if you miss=20
something it's a bug report rather than a security hole.

--=20
  Richard Huxton