database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-16 06:01:02 +03:00
Code Activity

Disable the use of Unicode escapes in string constants (U&'') when

Browse Source 
standard_conforming_strings is not on, for security reasons.
This commit is contained in:
Peter Eisentraut
2009-05-05 18:32:17 +00:00
parent 616bceb8cb
commit 40bc4c2605
4 changed files with 76 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
doc/src/sgml/syntax.sgml
View File

@ -1,4 +1,4 @@
<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.131 2009/04/27 16:27:36 momjian Exp $ -->
<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.132 2009/05/05 18:32:17 petere Exp $ -->
<chapter id="sql-syntax">
<title>SQL Syntax</title>
@ -499,6 +499,17 @@ U&amp;'d!0061t!+000061' UESCAPE '!'
specified.
</para>
<para>
Also, the Unicode escape syntax for string constants only works
when the configuration
parameter <xref linkend="guc-standard-conforming-strings"> is
turned on. This is because otherwise this syntax could confuse
clients that parse the SQL statements to the point that it could
lead to SQL injections and similar security issues. If the
parameter is set to off, this syntax will be rejected with an
error message.
</para>
<para>
To include the escape character in the string literally, write it
twice.