Functions | |
PGSTD::string PQXX_LIBEXPORT | pqxx::escape_binary (const PGSTD::string &bin) |
Escape binary string for inclusion in SQL. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::escape_binary (const char bin[]) |
Escape binary string for inclusion in SQL. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::escape_binary (const char bin[], size_t len) |
Escape binary string for inclusion in SQL. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::escape_binary (const unsigned char bin[]) |
Escape binary string for inclusion in SQL. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::escape_binary (const unsigned char bin[], size_t len) |
Escape binary string for inclusion in SQL. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::sqlesc (const char str[]) |
Escape nul-terminated string for inclusion in SQL strings. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::sqlesc (const char str[], size_t maxlen) |
Escape string for inclusion in SQL strings. | |
PGSTD::string PQXX_LIBEXPORT | pqxx::sqlesc (const PGSTD::string &) |
Escape string for inclusion in SQL strings. | |
template<typename T> | |
PGSTD::string | pqxx::Quote (const T &Obj, bool EmptyIsNull) |
Quote string for use in SQL. | |
template<> | |
PGSTD::string | pqxx::Quote (const PGSTD::string &Obj, bool EmptyIsNull) |
std::string version, on which the other versions are built | |
template<> | |
PGSTD::string | pqxx::Quote (const char *const &Obj, bool EmptyIsNull) |
Special case for const char *, accepting null pointer as null value. | |
template<int LEN> | |
PGSTD::string | pqxx::Quote (const char(&Obj)[LEN], bool EmptyIsNull) |
Specialization for string constants. | |
template<typename T> | |
PGSTD::string | pqxx::Quote (T Obj) |
Quote string for use in SQL. |
To understand what SQL injection vulnerabilities are and why they should be prevented, imagine you use the following SQL statement somewhere in your program:
TX.exec("SELECT number,amount " "FROM accounts " "WHERE allowed_to_see('" + userid + "','" + password + "')");
This shows a logged-in user important information on all accounts he is authorized to view. The userid and password strings are variables entered by the user himself.
Now, if the user is actually an attacker who knows (or can guess) the general shape of this SQL statement, imagine he enters the following password:
'x') OR ('x' = 'x
Does that make sense to you? Probably not. But if this is inserted into the SQL string by the C++ code above, the query becomes:
SELECT number,amount FROM accounts WHERE allowed_to_see('user','x') OR ('x' = 'x')
Is this what you wanted to happen? Probably not! The neat allowed_to_see() clause is completely circumvented by the "OR ('x' = 'x')" clause, which is always true. Therefore, the attacker will get to see all accounts in the database!
To prevent this from happening, use sqlesc:
TX.exec("SELECT number,amount " "FROM accounts " "WHERE allowed_to_see('" + sqlesc(userid) + "', " "'" + sqlesc(password) + "')");
Now, the quotes embedded in the attacker's string will be neatly escaped so they can't "break out" of the quoted SQL string they were meant to go into:
SELECT number,amount FROM accounts WHERE allowed_to_see('user', 'x'') OR (''x'' = ''x')
If you look carefully, you'll see that thanks to the added escape characters (a single-quote is escaped in SQL by doubling it) all we get is a very strange-looking password string--but not a change in the SQL statement.
|
Escape binary string for inclusion in SQL.
|
|
Escape binary string for inclusion in SQL.
|
|
Escape binary string for inclusion in SQL.
|
|
Escape binary string for inclusion in SQL.
|
|
Escape binary string for inclusion in SQL.
|
|
Quote string for use in SQL. This version of the function never generates null values.
|
|
Specialization for string constants. This specialization is a little complicated, because string constants are of the type char[], not of type const char * as one might expect. Note that the size of the array is part of the type, for which reason we need it in our template here. |
|
Special case for const char *, accepting null pointer as null value.
|
|
std::string version, on which the other versions are built
|
|
Quote string for use in SQL. Generate SQL-quoted version of string. If EmptyIsNull is set, an empty string will generate the null value rather than an empty string.
|
|
Escape string for inclusion in SQL strings. This function differs from similar ones based on libpq in that it handles embedded nul bytes correctly. Unlike its predecessor Quote(), this function does not add SQL-style single quotes around the result string; nor does it recognize and generate nulls. |
|
Escape string for inclusion in SQL strings. Reads and escapes input string. The string is terminated by either a nul character or the given byte length, whichever comes first.
|
|
Escape nul-terminated string for inclusion in SQL strings. Use this to sanitize strings that may contain characters like backslashes or quotes. You'll want to do this for all data received from outside your application that gets used in SQL--otherwise an attacker might crack your code by feeding it some string containing e.g. a closing quote followed by SQL commands you did not intend to execute. Unlike its predecessor Quote(), this function does not add SQL-style single quotes around the result string; nor does it recognize and generate nulls. |