Commit 5b13d1ff authored by Robert Haas's avatar Robert Haas

Reformat documentation of libpq escaping functions.

Modify the "Escaping Strings for Inclusion in SQL Commands" section
to use a <variablelist> as the preceding and following sections do,
and merge the "Escaping Binary Strings for Inclusion in SQL Commands"
section into it.

This changes only the formatting of these sections, not the content.
It is intended to lay the groundwork for a follow-on patch to add
some new escaping functions, but it makes sense to commit this first,
for clarity.
parent 16f2eadf
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.292 2009/12/02 14:07:25 momjian Exp $ --> <!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.293 2010/01/20 00:42:28 rhaas Exp $ -->
<chapter id="libpq"> <chapter id="libpq">
<title><application>libpq</application> - C Library</title> <title><application>libpq</application> - C Library</title>
...@@ -2925,31 +2925,37 @@ typedef struct { ...@@ -2925,31 +2925,37 @@ typedef struct {
<sect2 id="libpq-exec-escape-string"> <sect2 id="libpq-exec-escape-string">
<title>Escaping Strings for Inclusion in SQL Commands</title> <title>Escaping Strings for Inclusion in SQL Commands</title>
<indexterm zone="libpq-exec-escape-string">
<primary>PQescapeStringConn</primary>
</indexterm>
<indexterm zone="libpq-exec-escape-string">
<primary>PQescapeString</primary>
</indexterm>
<indexterm zone="libpq-exec-escape-string"> <indexterm zone="libpq-exec-escape-string">
<primary>escaping strings</primary> <primary>escaping strings</primary>
<secondary>in libpq</secondary> <secondary>in libpq</secondary>
</indexterm> </indexterm>
<variablelist>
<varlistentry>
<term>
<function>PQescapeStringConn</function>
<indexterm>
<primary>PQescapeStringConn</primary>
</indexterm>
</term>
<listitem>
<para> <para>
<function>PQescapeStringConn</function> escapes a string for use within an SQL <function>PQescapeStringConn</function> escapes a string for
command. This is useful when inserting data values as literal constants use within an SQL command. This is useful when inserting data
in SQL commands. Certain characters (such as quotes and backslashes) must values as literal constants in SQL commands. Certain characters
be escaped to prevent them from being interpreted specially by the SQL parser. (such as quotes and backslashes) must be escaped to prevent them
from being interpreted specially by the SQL parser.
<function>PQescapeStringConn</> performs this operation. <function>PQescapeStringConn</> performs this operation.
</para> </para>
<tip> <tip>
<para> <para>
It is especially important to do proper escaping when handling strings that It is especially important to do proper escaping when handling
were received from an untrustworthy source. Otherwise there is a security strings that were received from an untrustworthy source.
risk: you are vulnerable to <quote>SQL injection</> attacks wherein unwanted Otherwise there is a security risk: you are vulnerable to
SQL commands are fed to your database. <quote>SQL injection</> attacks wherein unwanted SQL commands are
fed to your database.
</para> </para>
</tip> </tip>
...@@ -3000,7 +3006,18 @@ typedef struct { ...@@ -3000,7 +3006,18 @@ typedef struct {
<function>PQescapeStringConn</> returns the number of bytes written <function>PQescapeStringConn</> returns the number of bytes written
to <parameter>to</>, not including the terminating zero byte. to <parameter>to</>, not including the terminating zero byte.
</para> </para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<function>PQescapeString</function>
<indexterm>
<primary>PQescapeString</primary>
</indexterm>
</term>
<listitem>
<para> <para>
<synopsis> <synopsis>
size_t PQescapeString (char *to, const char *from, size_t length); size_t PQescapeString (char *to, const char *from, size_t length);
...@@ -3025,18 +3042,9 @@ typedef struct { ...@@ -3025,18 +3042,9 @@ typedef struct {
hazard and should be avoided in favor of hazard and should be avoided in favor of
<function>PQescapeStringConn</>. <function>PQescapeStringConn</>.
</para> </para>
</sect2> </listitem>
</varlistentry>
<sect2 id="libpq-exec-escape-bytea">
<title>Escaping Binary Strings for Inclusion in SQL Commands</title>
<indexterm zone="libpq-exec-escape-bytea">
<primary>bytea</primary>
<secondary sortas="libpq">in libpq</secondary>
</indexterm>
<variablelist>
<varlistentry> <varlistentry>
<term> <term>
<function>PQescapeByteaConn</function> <function>PQescapeByteaConn</function>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment