Re: Escape handling in COPY, strings, psql

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: Escape handling in COPY, strings, psql
Дата
Msg-id 12092.1117393832@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: Escape handling in COPY, strings, psql  (Peter Eisentraut <peter_e@gmx.net>)
Ответы Re: Escape handling in COPY, strings, psql  (Bruce Momjian <pgman@candle.pha.pa.us>)
Список pgsql-hackers
Peter Eisentraut <peter_e@gmx.net> writes:
> I do support gradually phasing out backslash escapes in standard string 
> literals in the interest of portability.  Most of the current escape 
> sequences are of limited value anyway.  Let's think about ways to get 
> there:

I really don't think there is any way to get there without creating
gaping security holes in all kinds of client code :-(.  If we change
the escaping rules, then a client that is expecting some other rule
than happens to be in force will be subject to trivial SQL-injection
attacks.  This will make the autocommit fiasco pale by comparison ...

> For COPY, we would probably have to use a flag in the COPY command 
> itself either way (like already done for NULL AS).

The spec-compatibility argument for removing escapes does not apply to
COPY at all, so I see no need to fool with the COPY definition in any
case.
        regards, tom lane


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Andrew - Supernews
Дата:
Сообщение: Re: Simplifying unknown-literal handling
Следующее
От: Tom Lane
Дата:
Сообщение: Re: Simplifying unknown-literal handling