4 ms·
What is brain damaged about SQL parsing? But this is not about injection. This is about parsing mismatch, when you use different parsers that produce different
by jraph 3y ago
What is brain damaged about SQL parsing?
But this is not about injection. This is about parsing mismatch, when you use different parsers that produce different results for the same thing. The article is about URLs, curl's author has a good article on this too and this is the (biggest?) motivation behind providing an URL parsing API in libcurl.
https://daniel.haxx.se/blog/2022/01/10/dont-mix-url-parsers/ https://daniel.haxx.se/blog/2022/01/10/dont-mix-url-parsers/
- o11c 3y agoFor bad historical reasons, every SQL implementation has a completely bogus and wrong way to do string and identifier lexing. Nowadays most of them can be told to be more standard (no backslashes, single quotes are for strings, double quotes are for identifiers, repeat the quote to escape) but the default is usually still wrong. (and that's ignoring extensions) Postgres is sanest but even it casefolds in the wrong direction.
- marcosdumay 3y ago> but even it casefolds in the wrong direction I'd say that it's the only one that casefolds on the right direction. We don't need to keep using the upper-case only idioms from the 80's. We can have legible text nowadays. (And yes, it's non-standard, but there are plenty of things that are best done by ignoring the SQL standard.)