Re: question about security hole CVE-2006-2313 and UTF-8

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: question about security hole CVE-2006-2313 and UTF-8
Дата
Msg-id 14708.1148918469@sss.pgh.pa.us
обсуждение исходный текст
Ответ на question about security hole CVE-2006-2313 and UTF-8  ("Albe Laurenz" <all@adv.magwien.gv.at>)
Список pgsql-hackers
"Albe Laurenz" <all@adv.magwien.gv.at> writes:
> It seems to me that UTF-8 databases are safe.

IIRC we determined that using UTF8 *on both the client and server sides*
is safe.  You can get burnt with combinations such as server_encoding =
UTF8 and client_encoding = SJIS (exposing PQescapeString's naivete),
or with client_encoding = UTF8 and server_encoding = anything else
(exposing the server's weak validity checking during conversion).
        regards, tom lane


В списке pgsql-hackers по дате отправления: