You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Merge pull request 2ndQuadrant#2 from 3nids/schemasafe
`text || regclass`, via the `regclass` to `text` cast, already quotes table identifiers where necessary. The `quote_ident` calls here are unnecessary, and in fact incorrect as they result in quotes that were part of the table quoting becoming part of the identifier name.
Example:
```
create table "I will
hack your');DROP TABLE student;--" (
haha integer
);
SELECT '"I will
hack your'');DROP TABLE student;--"'::regclass::oid;
-- Produces oid 53060 here
regress=> SELECT 'DROP TABLE ' || 53060::oid::regclass;
?column?
------------------------------------
DROP TABLE "I will +
hack your');DROP TABLE student;--"
(1 row)
regress=> SELECT 'DROP TABLE ' || quote_ident(53060::oid::regclass::text);
?column?
--------------------------------------
DROP TABLE """I will +
hack your');DROP TABLE student;--"""
(1 row)
```
0 commit comments