News for hackers. Stuff that matters.

A comment on Writing a SQLite clone from scratch in C. Parent comment

Re:Writing a SQLite clone from scratch in C by wruza on Monday September 04, 2017 @03:24PM (#15170307)
I checked it for PostgreSQL right now, and it seems that libpq can send them OOB via PQexecParams() and networked integer buffers. But that's not the case with OpenResty's pgmoon driver, which doesn't have such an interface. E.g. Lapis framework built on top of that simply escape_literal()-izes all arguments and interpolates right into query text. So, YMMW with specific (or generic) drivers.

Placeholders are there for those who tries to concatenate queries by hand; having them properly escaped in protocol should not defeat client-side security purpose.

[ Parent | on HN ]
Re:Writing a SQLite clone from scratch in C by anton_gogolev on Tuesday September 05, 2017 @01:38AM (#15172763)
You can never properly escape user input, so this escape_literal() is a ticking timebomb.
[ Parent | on HN ]
Re:Writing a SQLite clone from scratch in C by icebraining on Tuesday September 05, 2017 @04:21AM (#15173362)
How come it's impossible to properly escape user input? I get that it's hard if the format is complex, but I don't see what makes it categorically impossible, especially for a simple format like an SQL string. You just double every single quote and then surround the whole thing with single quotes.
[ Parent | on HN ]
Re:Writing a SQLite clone from scratch in C by anton_gogolev on Tuesday September 05, 2017 @10:45AM (#15175680)
> ...every single quote...

And then you come across \u0027 and you're screwed.

[ Parent | on HN ]
Re:Writing a SQLite clone from scratch in C by wruza on Tuesday September 05, 2017 @06:41PM (#15179688)
Do you know any decent server that interprets 6-char \uxxxx sequences as part of its top-level query syntax? I mean, how do you safely pass '\u0027' literal to it anyway? If you can't, then its literals and escaping are broken by design, so it is good to know from the start of using it.

Edit: removed double backslash from literal to not confuse it with host language's escaping.

[ Parent | on HN ]
Re:Writing a SQLite clone from scratch in C by icebraining on Tuesday September 05, 2017 @11:01AM (#15175866)
If you use a broken RDBMS, maybe. The standard is quite clear, and that certainly doesn't work in PortgreSQL.
[ Parent | on HN ]