PG do not accept quoted names for tables/columns
От | Yaniv Hamo |
---|---|
Тема | PG do not accept quoted names for tables/columns |
Дата | |
Msg-id | Pine.GSO.4.33_heb2.09.0302061122010.23338-100000@csd обсуждение исходный текст |
Ответы |
Re: PG do not accept quoted names for tables/columns
Re: PG do not accept quoted names for tables/columns Re: PG do not accept quoted names for tables/columns |
Список | pgsql-bugs |
Hi, I noticed that Postgres issues a fatal error when given a quoted name of table or column. This is a problem in secured cgi scripts, which quote everything they get from the user, to avoid malicious users from trying to execute SQL commands using some engineered input. shared# select version(); version --------------------------------------------------------------------- PostgreSQL 7.3.1 on i686-pc-linux-gnu, compiled by GCC egcs-2.91.66 shared# CREATE TABLE 'testtable' ('test' INT); ERROR: parser: parse error at or near "'testtable'" at character 14 Thanks and have a nice day, Yaniv
В списке pgsql-bugs по дате отправления: