database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-08 11:42:09 +03:00
Code Activity

Remove libpq's PQescapeIdentifier(), not safe from injection attacks.

Browse Source
This commit is contained in:
Bruce Momjian
2006-07-04 13:22:15 +00:00
parent 530eab592c
commit 3fafac3f62
4 changed files with 4 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
src/interfaces/libpq/fe-exec.c
View File

@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-exec.c,v 1.187 2006/06/27 00:03:41 momjian Exp $
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-exec.c,v 1.188 2006/07/04 13:22:15 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@ -2515,42 +2515,6 @@ PQescapeString(char *to, const char *from, size_t length)
static_std_strings);
}
/*
* Escaping arbitrary strings to get valid SQL identifier strings.
*
* Replaces " with "".
*
* length is the length of the source string. (Note: if a terminating NUL
* is encountered sooner, PQescapeIdentifier stops short of "length"; the behavior
* is thus rather like strncpy.)
*
* For safety the buffer at "to" must be at least 2*length + 1 bytes long.
* A terminating NUL character is added to the output string, whether the
* input is NUL-terminated or not.
*
* Returns the actual length of the output (not counting the terminating NUL).
*/
size_t
PQescapeIdentifier(char *to, const char *from, size_t length)
{
const char *source = from;
char *target = to;
size_t remaining = length;
while (remaining > 0 && *source != '\0')
{
if (*source == '"')
*target++ = *source;
*target++ = *source++;
remaining--;
}
/* Write the terminating NUL character. */
*target = '\0';
return target - to;
}
/*
* PQescapeBytea - converts from binary string to the
* minimal encoding necessary to include the string in an SQL