4 ms·

That would be silly, then the backslash will be shown everywhere.

tux3 11y ago
I'm not advocating for escape characters instead of proper prepared queries, but in that case you would "simply" need to un-escape the name before showing it.
- paulasmuth 11y ago
  No, you don't need to unescape it when displaying it. This SQL literal string: 'Gijs in \'t Veld' Is a representation for these ASCII bytes/content: Gijs in 't Veld In other words. The backslash will not be stored as part of the string into the database. It's just a hint to the SQL parser that the following single quote should be interpreted as a literal single quote char and not as the end-of-string-character. From a security perspective there is nothing more "proper" about prepared queries than correctly escaped non-prepared queries.
paulasmuth 11y ago
I can't tell if you're trolling or not, but this is not how string escaping works in SQL or any other programming language that I know. >> SELECT 'here is an apostrophe: \''; >> returns: here is an apostrophe: ' The backslash is not part of the string but just a hint to the compiler. The literal string '\'' represents a one byte (if ASCII) string containing only a single apostrophe character. https://en.wikipedia.org/wiki/Escape_character https://en.wikipedia.org/wiki/Escape_character
- jameshart 11y ago
  There's a difference between saying that Gijs in \'t Veld is a 'sanitized' version of Gijs in 't Veld and saying that 'Gijs in \'t Veld' is a SQL String literal representing the string Gijs in 't Veld
- Scarblac 11y ago
  I meant that if you were to "sanitize" all input your program gets by replacing "'" by "\'" in there everywhere, then assuming that most of the rest of your program actually works as normal and calls libraries that do things correctly etc, you're just going to have backslashes show up because they're in the string. Maybe you also echo the string back to HTML immediately before it ever goes into SQL, et cetera. Only escaping quotes that are inserted directly into SQL query strings is not what I understood by "sanitizing all input".

tux3 11y ago

I'm not advocating for escape characters instead of proper prepared queries, but in that case you would "simply" need to un-escape the name before showing it.

paulasmuth 11y ago
No, you don't need to unescape it when displaying it. This SQL literal string: 'Gijs in \'t Veld' Is a representation for these ASCII bytes/content: Gijs in 't Veld In other words. The backslash will not be stored as part of the string into the database. It's just a hint to the SQL parser that the following single quote should be interpreted as a literal single quote char and not as the end-of-string-character. From a security perspective there is nothing more "proper" about prepared queries than correctly escaped non-prepared queries.

paulasmuth 11y ago

I can't tell if you're trolling or not, but this is not how string escaping works in SQL or any other programming language that I know. >> SELECT 'here is an apostrophe: \''; >> returns: here is an apostrophe: ' The backslash is not part of the string but just a hint to the compiler. The literal string '\'' represents a one byte (if ASCII) string containing only a single apostrophe character. https://en.wikipedia.org/wiki/Escape_character https://en.wikipedia.org/wiki/Escape_character

jameshart 11y ago
There's a difference between saying that Gijs in \'t Veld is a 'sanitized' version of Gijs in 't Veld and saying that 'Gijs in \'t Veld' is a SQL String literal representing the string Gijs in 't Veld
Scarblac 11y ago
I meant that if you were to "sanitize" all input your program gets by replacing "'" by "\'" in there everywhere, then assuming that most of the rest of your program actually works as normal and calls libraries that do things correctly etc, you're just going to have backslashes show up because they're in the string. Maybe you also echo the string back to HTML immediately before it ever goes into SQL, et cetera. Only escaping quotes that are inserted directly into SQL query strings is not what I understood by "sanitizing all input".