I wrote:
> Markus Winand <markus.winand@winand.at> writes:
>> The XML output of explain potentially outputs the XML tag names "I/O-Write-Time"
>> and "I/O-Read-Time", which are invalid due to the slash.
> Ooops.
After further thought I decided we should go with the whitelist solution.
The extra time needed to produce XML-format output isn't really likely to
bother anyone. And given that this bug escaped notice for several years,
it seems likely that the next time somebody decides to be creative about
picking a tag name, we might not notice an XML syntax violation for
several more years. So a future-proof fix seems advisable.
I pushed a patch using the strchr() approach. Thanks for reporting this!
regards, tom lane