client9 / client9/libinjection

PgSQL $$ quote

Open
#97 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
1k
Forks
282
PR merge metrics
No merged PRs in 30d

Description

This is an FN, but only valid on PgSQL.

https://libinjection.client9.com/diagnostics?id=1%27+or+%24xx%24hello%24xx%24+%3C%3E+%271&type=tokens

PgSQL allow a "tag" between the two dollar signs. So it can be $xyz$string content here$xyz$ (note the "xyz")

PgSQL doesn't mention what chars are allowed between the two dollars, http://www.postgresql.org/docs/9.1/static/sql-syntax-lexical.html, so maybe we should support all chars except '$' (and I don't know what will happen if it is \r, \n???)

And be careful when handling

$xyz$abc $xyz_ abc $xyz$, note the "$xyz_" inside the quote.

Sam

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.