Thread: PQescapeStringConn problem

Hi. I am using libpq in my C application to comunicate with database.
Application gets input from untrustworthy source and then uses it in
SQL requests. To avoid SQL injection I want to use PQescapeStringConn
function. The problem is, that i don't know how to properly use this
function.

http://www.postgresql.org/docs/7.3/static/libpq-exec.html#LIBPQ-EXEC-ESCAPE-STRING

How can I know the size of "to" buffer before I call this function? If
I don't know it it may cause heap overflow..
Can you provide some example how this function is used in other apps?

Oliver Kindernay <oliver.kindernay@gmail.com> writes:
> Hi. I am using libpq in my C application to comunicate with database.
> Application gets input from untrustworthy source and then uses it in
> SQL requests. To avoid SQL injection I want to use PQescapeStringConn
> function. The problem is, that i don't know how to properly use this
> function.

> http://www.postgresql.org/docs/7.3/static/libpq-exec.html#LIBPQ-EXEC-ESCAPE-STRING

> How can I know the size of "to" buffer before I call this function?

I trust you're not *really* using Postgres 7.3?  But in any case,
that documentation says

    to shall point to a buffer that is able to hold at least one more byte
    than twice the value of length

ie maximum output is 2 bytes per input byte, plus a null terminator.

            regards, tom lane

Oh, my bad, didn't read carefully. And not, i am not using 7.3, that's
another failure in my copy-paste skills :)

2010/5/15 Tom Lane <tgl@sss.pgh.pa.us>:
> Oliver Kindernay <oliver.kindernay@gmail.com> writes:
>> Hi. I am using libpq in my C application to comunicate with database.
>> Application gets input from untrustworthy source and then uses it in
>> SQL requests. To avoid SQL injection I want to use PQescapeStringConn
>> function. The problem is, that i don't know how to properly use this
>> function.
>
>> http://www.postgresql.org/docs/7.3/static/libpq-exec.html#LIBPQ-EXEC-ESCAPE-STRING
>
>> How can I know the size of "to" buffer before I call this function?
>
> I trust you're not *really* using Postgres 7.3?  But in any case,
> that documentation says
>
>        to shall point to a buffer that is able to hold at least one more byte
>        than twice the value of length
>
> ie maximum output is 2 bytes per input byte, plus a null terminator.
>
>                        regards, tom lane
>