4 ms·
To clarify, it looks like "postgres_escape" is the way to do escaping. Unfortunately, it seems a bit awkward to differentiate between empty and NULL strings. T
by jeffdavis 13y ago
To clarify, it looks like "postgres_escape" is the way to do escaping.
Unfortunately, it seems a bit awkward to differentiate between empty and NULL strings. That's something to be careful of.
Also, I really think this should be included in the blog post, even if it's simple. Protecting against SQL injection is not optional, so leaving it out only muddies the comparison with more traditional frameworks. Also, there's always going to be someone that copies and pastes it without thinking much about it.
That being said, this is very cool and I hope to see more development and exploration in this area.
- ricny046 13y agoGood point. I will update the examples in the blog post as soon as possible.
- ams6110 13y agoFrom the docs re postgres_escape: "Because nginx cannot tell the difference between empty and non-existing strings, all empty strings are by default escaped to NULL value." This behavior actually is what anyone who has used Oracle is accustomed to (empty string is NULL). I don't recall the default behavior in Postgres but Postgres is "Oracle-ish" in a lot of ways so I would be surprised if this is not the default there as well.
- jeffdavis 13y agoThe "empty string is NULL" behavior you describe is a standards violation. Postgres does not follow Oracle off of that particular cliff; postgres does differentiate between the two.
- sixbrx 13y ago... And Oracle is going to change that any day now for varchar, which is why they've been hounding us to use "varchar2" from time immemorial. (They wouldn't have any other reason to encourage varchar2, would they?) :)