Thread: don't understand something about backslashes

don't understand something about backslashes

From

Dennis Gearon

Date:

20 March 2003, 17:37:46

I have a varchar that is 64 wide. I prescape stuff like the '-'
character to prevent SQL injection.

Here is the EXACT field value that I inserted recently,for a test. It
comes to approx 100 chars.

'\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1'::varchar,

I insert that and get:

    NO ERROR

When I look at the record in phpPgAdmin, the slashes don't show up in
the record.

So, do they make it to the record, anyone know? What do I have to do for
the PostgreSQL engine to prevent '--' character from ending a line in a
a string? Or in general, get the backslashes in the record?

Re: don't understand something about backslashes

From

Stephan Szabo

Date:

20 March 2003, 17:57:00

On Thu, 20 Mar 2003, Dennis Gearon wrote:

> I have a varchar that is 64 wide. I prescape stuff like the '-'
> character to prevent SQL injection.
>
> Here is the EXACT field value that I inserted recently,for a test. It
> comes to approx 100 chars.
>
> '\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1'::varchar,
>
> I insert that and get:
>
>     NO ERROR
>
> When I look at the record in phpPgAdmin, the slashes don't show up in
> the record.

The backslashes are escaping what follows.  If you want two backslashes
you need to double them probably.

Re: don't understand something about backslashes

From

Dennis Gearon

Date:

20 March 2003, 18:05:04

I print the string out before sending it to the p-l engine, and they are
there.

Where are they being interpreted as escaping, and removed:

    PHP
    ADODB (the php library I'm using)
    Postgres?

Obviously, I'm looking on this list to see if they get removed by the
libpq library or the backend.

I didn't know escaping chars were removed ...... makes sense though.

Stephan Szabo wrote:
> On Thu, 20 Mar 2003, Dennis Gearon wrote:
>
>
>>I have a varchar that is 64 wide. I prescape stuff like the '-'
>>character to prevent SQL injection.
>>
>>Here is the EXACT field value that I inserted recently,for a test. It
>>comes to approx 100 chars.
>>
>>'\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1'::varchar,
>>
>>I insert that and get:
>>
>>    NO ERROR
>>
>>When I look at the record in phpPgAdmin, the slashes don't show up in
>>the record.
>
>
> The backslashes are escaping what follows.  If you want two backslashes
> you need to double them probably.
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 2: you can get off all lists at once with the unregister command
>     (send "unregister YourEmailAddressHere" to majordomo@postgresql.org)
>

Re: don't understand something about backslashes

From

Stephan Szabo

Date:

20 March 2003, 18:21:26

On Thu, 20 Mar 2003, Dennis Gearon wrote:

> I print the string out before sending it to the p-l engine, and they are
> there.
>
> Where are they being interpreted as escaping, and removed:
>
>     PHP
>     ADODB (the php library I'm using)
>     Postgres?
>
> Obviously, I'm looking on this list to see if they get removed by the
> libpq library or the backend.
>
> I didn't know escaping chars were removed ...... makes sense though.

Postgres AFAIK.

Re: don't understand something about backslashes

From

Dennis Gearon

Date:

20 March 2003, 18:27:23

Actually, that is most good!

The backslash causes the character to be treated JUST as a character,
not as part of some command,right?

But then it gets consumed so that it doesn't increase the size of a data
field. Cool!

So I don't have to unescape it when I draw the data back out of the
database, oh so cool!

Darren Ferguson wrote:
> The back slash on insert is just escaping the character so Postgres will
> not throw errors when adding ' or any other specialized charachters into
> the database.
>
> If you want the backslashes to be in the record you have to double escape
> them as shown below.
>
> HTH
>
> Darren
>
> oss=> create table test (id varchar(64) not null);
> CREATE TABLE
> oss=> insert into test values ('darren\'s');
> INSERT 9648444 1
> oss=> select * from test;
>     id
> ----------
>  darren's
> (1 row)
>
> oss=> insert into test values ('darren\\\'s');
> INSERT 9648445 1
> oss=> select * from test;
>     id
> -----------
>  darren's
>  darren\'s
> (2 rows)
>
>
> On Thu, 20 Mar 2003, Dennis Gearon wrote:
>
>
>>I have a varchar that is 64 wide. I prescape stuff like the '-'
>>character to prevent SQL injection.
>>
>>Here is the EXACT field value that I inserted recently,for a test. It
>>comes to approx 100 chars.
>>
>>'\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1'::varchar,
>>
>>I insert that and get:
>>
>>    NO ERROR
>>
>>When I look at the record in phpPgAdmin, the slashes don't show up in
>>the record.
>>
>>So, do they make it to the record, anyone know? What do I have to do for
>>the PostgreSQL engine to prevent '--' character from ending a line in a
>>a string? Or in general, get the backslashes in the record?
>>
>>
>>
>>
>>
>>
>>---------------------------(end of broadcast)---------------------------
>>TIP 6: Have you searched our list archives?
>>
>>http://archives.postgresql.org
>>
>
>

Re: don't understand something about backslashes

From

Darren Ferguson

Date:

22 March 2003, 04:11:29

The back slash on insert is just escaping the character so Postgres will
not throw errors when adding ' or any other specialized charachters into
the database.

If you want the backslashes to be in the record you have to double escape
them as shown below.

HTH

Darren

oss=> create table test (id varchar(64) not null);
CREATE TABLE
oss=> insert into test values ('darren\'s');
INSERT 9648444 1
oss=> select * from test;
    id
----------
 darren's
(1 row)

oss=> insert into test values ('darren\\\'s');
INSERT 9648445 1
oss=> select * from test;
    id
-----------
 darren's
 darren\'s
(2 rows)


On Thu, 20 Mar 2003, Dennis Gearon wrote:

> I have a varchar that is 64 wide. I prescape stuff like the '-'
> character to prevent SQL injection.
>
> Here is the EXACT field value that I inserted recently,for a test. It
> comes to approx 100 chars.
>
> '\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1\-1'::varchar,
>
> I insert that and get:
>
>     NO ERROR
>
> When I look at the record in phpPgAdmin, the slashes don't show up in
> the record.
>
> So, do they make it to the record, anyone know? What do I have to do for
> the PostgreSQL engine to prevent '--' character from ending a line in a
> a string? Or in general, get the backslashes in the record?
>
>
>
>
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 6: Have you searched our list archives?
>
> http://archives.postgresql.org
>

--
Darren Ferguson