PG do not accept quoted names for tables/columns

Поиск
Список
Период
Сортировка
От Yaniv Hamo
Тема PG do not accept quoted names for tables/columns
Дата
Msg-id Pine.GSO.4.33_heb2.09.0302061122010.23338-100000@csd
обсуждение исходный текст
Ответы Re: PG do not accept quoted names for tables/columns  (Stephan Szabo <sszabo@megazone23.bigpanda.com>)
Re: PG do not accept quoted names for tables/columns  (Andrew McMillan <andrew@catalyst.net.nz>)
Re: PG do not accept quoted names for tables/columns  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-bugs
Hi,
I noticed that Postgres issues a fatal error when given a quoted name of
table or column. This is a problem in secured cgi scripts, which quote
everything they get from the user, to avoid malicious users from trying to
execute SQL commands using some engineered input.


shared# select version();
                               version
---------------------------------------------------------------------
 PostgreSQL 7.3.1 on i686-pc-linux-gnu, compiled by GCC egcs-2.91.66


shared# CREATE TABLE 'testtable' ('test' INT);
ERROR:  parser: parse error at or near "'testtable'" at character 14


Thanks and have a nice day,
Yaniv

В списке pgsql-bugs по дате отправления:

Предыдущее
От: "David Heggie"
Дата:
Сообщение: Bug with Temp table with serial column
Следующее
От: "Gershon Geva"
Дата:
Сообщение: unsubscribe