
On Mon, June 03 Bruce wrote:
> > On Wed, May 08, 2002 at 06:47:46PM +0200, Zeugswetter SB SD Andreas wrote:
> > > When we are talking about the places where you need double escaping 
> > > (once for parser, once for input function) to make it work, I would also 
> > > say that that is very cumbersome (not broken, since it is thus documented) :-) 
> > > I would also default to strict ANSI, but not depricate the escaping when set.
> > > All imho of course.

> Yes, these are good points.  Our big problem is that we use backslash
> for two things, one for escaping single quotes and for escaping standard
> C characters, like \n.  While we can use the standard-supported '' to
> insert single quotes, what should we do with \n?  The problem is
> switching to standard ANSI solution reduces our functionality.

The problem imho is, that this (no doubt in many cases valuable)
feature reduces the functionality from the ANSI SQL perspective.
Consider a field that is supposed to store Windows filenames,
nam_file='C:\node1\resend\b.dat' :-)

Thus I think a GUC to turn off all escaping except '' would be valuable.

Andreas

Mon, 3 Jun 2002 13:20:13 +0200
"Zeugswetter Andreas SB SD" <ZeugswetterA@spardat.at>
Re: non-standard escapes in string literals
At 01:20 PM 6/3/02 +0200, Zeugswetter Andreas SB SD wrote:
> > for two things, one for escaping single quotes and for escaping standard
> > C characters, like \n.  While we can use the standard-supported '' to
> > insert single quotes, what should we do with \n?  The problem is
> > switching to standard ANSI solution reduces our functionality.
>
>The problem imho is, that this (no doubt in many cases valuable)
>feature reduces the functionality from the ANSI SQL perspective.
>Consider a field that is supposed to store Windows filenames,
>nam_file='C:\node1\resend\b.dat' :-)
>
>Thus I think a GUC to turn off all escaping except '' would be valuable.

With current behaviour 'C:\node1\resend\b.dat' can be quoted as 
'C:\\node1\\resend\\b.dat'

But for the ANSI standard how does one stuff \r\n\t and other control 
characters into the database?

If there's no way other than actually sending the control characters then 
that is a bad idea especially from a security viewpoint.

Cheerio,
Link.


Mon, 03 Jun 2002 23:25:10 +0800
Lincoln Yeoh <lyeoh@pop.jaring.my>
Re: non-standard escapes in string literals
Lincoln Yeoh writes:

> But for the ANSI standard how does one stuff \r\n\t and other control
> characters into the database?
>
> If there's no way other than actually sending the control characters then
> that is a bad idea especially from a security viewpoint.

Why??

-- 
Peter Eisentraut   peter_e@gmx.net


Tue, 4 Jun 2002 21:58:27 +0200 (CEST)
Peter Eisentraut <peter_e@gmx.net>
Re: non-standard escapes in string literals
At 09:58 PM 6/4/02 +0200, Peter Eisentraut wrote:
>Lincoln Yeoh writes:
>
> > But for the ANSI standard how does one stuff \r\n\t and other control
> > characters into the database?
> >
> > If there's no way other than actually sending the control characters then
> > that is a bad idea especially from a security viewpoint.
>
>Why??

Quoting is to help separate data from commands. Though '' is sufficient for 
quoting ' it seems to me not sufficient for control characters.

There could be control characters that cause problems with the DB, and 
people may not be sufficiently aware of potential problems. If you just 
remove the problematic characters, it means you can't store them in the 
database - the db can become less useful.

Whereas with the current way of quoting control characters, if you are 
unsure what to quote, you could safely quote every "untrusted" character. 
Less chance of things going wrong. Also being able to quote allows you to 
store control characters in the database.

An example of what could go wrong: a RDBMS may treat raw backspaces as part 
of the command stream and not the data, and thus

insert into pics (data) values ('$CGIPARAM')
could become -
insert into pics (data) values('....JFIF^H^H^H^H^H^H...^H^H^HUPDATE row 
from IMPORTANT where (rowid='1')
Which is treated as
UPDATE row from IMPORTANT where (rowid='1')

And so a file upload becomes an insiduous alteration of important data.

Hope that helps,
Link.



Wed, 05 Jun 2002 12:20:08 +0800
Lincoln Yeoh <lyeoh@pop.jaring.my>
Re: non-standard escapes in string literals