diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2009-05-05 18:32:17 +0000 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2009-05-05 18:32:17 +0000 |
| commit | 40bc4c260508e8a2579bd2106e1f81b6795d147b (patch) | |
| tree | d2ad86c55d2795e0746a56f93d0c56852b315147 /doc/src | |
| parent | 616bceb8cb67c4f7641d933d0963373963e7492e (diff) | |
| download | postgresql-40bc4c260508e8a2579bd2106e1f81b6795d147b.tar.gz postgresql-40bc4c260508e8a2579bd2106e1f81b6795d147b.zip | |
Disable the use of Unicode escapes in string constants (U&'') when
standard_conforming_strings is not on, for security reasons.
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/syntax.sgml | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/doc/src/sgml/syntax.sgml b/doc/src/sgml/syntax.sgml index 48bf5a4feb8..cf929f0b72e 100644 --- a/doc/src/sgml/syntax.sgml +++ b/doc/src/sgml/syntax.sgml @@ -1,4 +1,4 @@ -<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.131 2009/04/27 16:27:36 momjian Exp $ --> +<!-- $PostgreSQL: pgsql/doc/src/sgml/syntax.sgml,v 1.132 2009/05/05 18:32:17 petere Exp $ --> <chapter id="sql-syntax"> <title>SQL Syntax</title> @@ -500,6 +500,17 @@ U&'d!0061t!+000061' UESCAPE '!' </para> <para> + Also, the Unicode escape syntax for string constants only works + when the configuration + parameter <xref linkend="guc-standard-conforming-strings"> is + turned on. This is because otherwise this syntax could confuse + clients that parse the SQL statements to the point that it could + lead to SQL injections and similar security issues. If the + parameter is set to off, this syntax will be rejected with an + error message. + </para> + + <para> To include the escape character in the string literally, write it twice. </para> |