pg.ddx.io pgsql-sql@postgresql.org mailing list archive
help / color / mirror / Atom feedSpecial characters in SQL queries
7+ messages / 5 participants
[nested] [flat]
* Special characters in SQL queries
@ 2003-03-09 19:53 Vernon Wu <vernonw@gatewaytech.com>
0 siblings, 0 replies; 7+ messages in thread
From: Vernon Wu @ 2003-03-09 19:53 UTC (permalink / raw)
To: pgsql-sql
First a single quote in text, when a backforward slash in a file path, what other special characters need padded in two
backslashes before using the data in a SQL statement?
After hours' search in the PostgreSQL archive, I find a releted information on the http://www.ca.postgresql.org/users-
lounge/docs/7.2/postgres/arrays.html. It's about array data though.
How can I find out those characters so that I can pre-process them before a SQL query?
Thanks for your information.
Vernon
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Special characters in SQL queries
@ 2003-03-11 15:32 Christoph Haller <ch@rodos.fzk.de>
0 siblings, 1 reply; 7+ messages in thread
From: Christoph Haller @ 2003-03-11 15:32 UTC (permalink / raw)
To: pgsql-sql; +Cc: vernonw@gatewaytech.com
>
> First a single quote in text, when a backforward slash in a file path,
what other special characters need padded in t
wo
> backslashes before using the data in a SQL statement?
>
> After hours' search in the PostgreSQL archive, I find a releted
information on the http://www.ca.postgresql.org/users
-
> lounge/docs/7.2/postgres/arrays.html. It's about array data though.
>
> How can I find out those characters so that I can pre-process them
before a SQL query?
>
What about
size_t PQescapeString (char *to, const char *from, size_t length);
from the libpq - C Library?
Regards, Christoph
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Special characters in SQL queries
@ 2003-03-12 03:28 Vernon Wu <vernonw@gatewaytech.com>
parent: Christoph Haller <ch@rodos.fzk.de>
0 siblings, 3 replies; 7+ messages in thread
From: Vernon Wu @ 2003-03-12 03:28 UTC (permalink / raw)
To: pgsql-sql@postgresql.org, Christoph Haller <ch@rodos.fzk.de>
Thank Christoph for your information.
I don't program in C at all, but Java. Although I can make a way to call the C library function from Java, it isn't suitable
solution, I believe.
I only desire to find out all the type of characters at the present time so that I can strip out any potential problem sources
in text. Who know what characters a user will enter.
Vernon
11/03/2003 7:32:33 AM, Christoph Haller <ch@rodos.fzk.de> wrote:
>>
>> First a single quote in text, when a backforward slash in a file path,
>what other special characters need padded in t
>wo
>> backslashes before using the data in a SQL statement?
>>
>> After hours' search in the PostgreSQL archive, I find a releted
>information on the http://www.ca.postgresql.org/users
>-
>> lounge/docs/7.2/postgres/arrays.html. It's about array data though.
>>
>> How can I find out those characters so that I can pre-process them
>before a SQL query?
>>
>What about
>size_t PQescapeString (char *to, const char *from, size_t length);
>from the libpq - C Library?
>
>Regards, Christoph
>
>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Special characters in SQL queries
@ 2003-03-12 05:50 Rupa Schomaker <rupa-list@rupa.com>
parent: Vernon Wu <vernonw@gatewaytech.com>
2 siblings, 0 replies; 7+ messages in thread
From: Rupa Schomaker @ 2003-03-12 05:50 UTC (permalink / raw)
To: pgsql-sql
-----BEGIN PGP SIGNED MESSAGE-----
Vernon Wu <vernonw@gatewaytech.com> writes:
> I don't program in C at all, but Java. Although I can make a way to
> call the C library function from Java, it isn't suitable solution, I
> believe.
>
> I only desire to find out all the type of characters at the present
> time so that I can strip out any potential problem sources in
> text. Who know what characters a user will enter.
Why not strictly use bind variables? That way you never have to worry
about escaping and you get the added bonus of using prepared
statements?
- --
- -rupa
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: Processed by Mailcrypt 3.5.7, an Emacs/PGP interface
iQEVAwUBPm7KqnHDM4ucEopdAQFs+Af/d2DMjOWrLhN5S0TdwJGrelvYMwCvpSd3
QZrdx2fv3tGHx1JjqlZgKRKrn08GWMe+AjN2I89FfjyG0vurOqLSAJA4pGI0guGF
9cqXWQJTXd5yMEencG3Va7VhF8WcEmGX1iC891s7xdssmQW1myKZIKwrLPO3jVla
SRFqh4xPycyJk8L6McbWoGwQa5I+xvLKWlS38tr1tQZu4bbg0o4pDnTYVLvdswH/
oM6ZOk4fHwK7/E4071jNYTWe9azmylJfWpqJCELc+9k4afibcdOTLXvWk0Re438d
6wGadJ5tpT65onaSYzpUENTmedY1CPAG+ViL+t8rMgBI/jGoKFXxJg==
=t25X
-----END PGP SIGNATURE-----
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Special characters in SQL queries
@ 2003-03-12 06:44 Victor Yegorov <viy@pirmabanka.lv>
parent: Vernon Wu <vernonw@gatewaytech.com>
2 siblings, 0 replies; 7+ messages in thread
From: Victor Yegorov @ 2003-03-12 06:44 UTC (permalink / raw)
To: pgsql-sql
* Vernon Wu <vernonw@gatewaytech.com> [12.03.2003 05:36]:
> Thank Christoph for your information.
>
> I don't program in C at all, but Java. Although I can make a way to call the C library function from Java, it isn't suitable
> solution, I believe.
>
> I only desire to find out all the type of characters at the present time so that I can strip out any potential problem sources
> in text. Who know what characters a user will enter.
>
Take a look at the source code of PQescapeString() in the source
distribution of postgres. I hope, you'll find all the chars you're
interested in.
> >>
> >> First a single quote in text, when a backforward slash in a file path,
> >what other special characters need padded in t
> >wo
> >> backslashes before using the data in a SQL statement?
> >>
> >> After hours' search in the PostgreSQL archive, I find a releted
> >information on the http://www.ca.postgresql.org/users
> >-
> >> lounge/docs/7.2/postgres/arrays.html. It's about array data though.
> >>
> >> How can I find out those characters so that I can pre-process them
> >before a SQL query?
> >>
> >What about
> >size_t PQescapeString (char *to, const char *from, size_t length);
--
Victor Yegorov
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Special characters in SQL queries
@ 2003-03-12 08:14 Christoph Haller <ch@rodos.fzk.de>
0 siblings, 0 replies; 7+ messages in thread
From: Christoph Haller @ 2003-03-12 08:14 UTC (permalink / raw)
To: pgsql-sql; +Cc: vernonw@gatewaytech.com
>
> I don't program in C at all, but Java. Although I can make a way to
call the C library function
> from Java, it isn't suitable solution, I believe.
> I only desire to find out all the type of characters at the present
time so that I can strip out any
> potential problem sources in text. Who know what characters a user
will enter.
>
As Victor Yegorov mentioned
Take a look at the source code of PQescapeString() in the source
distribution of postgres. I hope, you'll find all the chars you're
interested in.
or refer to Binary Strings within the Data Types chapter of the doc.
This shows how to deal with "non-printables" and "printables".
Regards, Christoph
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Special characters in SQL queries
@ 2003-03-12 09:44 Richard Huxton <dev@archonet.com>
parent: Vernon Wu <vernonw@gatewaytech.com>
2 siblings, 0 replies; 7+ messages in thread
From: Richard Huxton @ 2003-03-12 09:44 UTC (permalink / raw)
To: vernonw@gatewaytech.com; pgsql-sql
On Wednesday 12 Mar 2003 3:28 am, Vernon Wu wrote:
> Thank Christoph for your information.
>
> I don't program in C at all, but Java. Although I can make a way to call
> the C library function from Java, it isn't suitable solution, I believe.
>
> I only desire to find out all the type of characters at the present time so
> that I can strip out any potential problem sources in text. Who know what
> characters a user will enter.
Don't do Java myself, but I can't believe the JDBC (or whatever) classes don't
do this for you. In any case, you can look at the code for the C function -
it should be fairly obvious what characters it's working on.
If you do want to write your own, it's best not to strip certain characters,
but rather to list those you will allow through. That way if you miss
something it's a bug report rather than a security hole.
--
Richard Huxton
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2003-03-12 09:44 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2003-03-09 19:53 Special characters in SQL queries Vernon Wu <vernonw@gatewaytech.com>
2003-03-11 15:32 Re: Special characters in SQL queries Christoph Haller <ch@rodos.fzk.de>
2003-03-12 03:28 ` Vernon Wu <vernonw@gatewaytech.com>
2003-03-12 05:50 ` Rupa Schomaker <rupa-list@rupa.com>
2003-03-12 06:44 ` Victor Yegorov <viy@pirmabanka.lv>
2003-03-12 09:44 ` Richard Huxton <dev@archonet.com>
2003-03-12 08:14 Re: Special characters in SQL queries Christoph Haller <ch@rodos.fzk.de>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox