PyGreSQL 3.8 did not use PostgreSQL’s safe string
and bytea
functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string()
and pg.escape_bytea()
are still available, but applications will have to be adjusted to use the new pyobj.escape_string()
and pyobj.escape_bytea()
functions. For example, code containing:
import pg
connection = pg.connect(...)
escaped = pg.escape_string(untrusted_input)
should be adjusted to use:
import pg
connection = pg.connect(...)
escaped = connection.escape_string(untrusted_input)
References
PyGreSQL 3.8 did not use PostgreSQL’s safe
string
andbytea
functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility,pg.escape_string()
andpg.escape_bytea()
are still available, but applications will have to be adjusted to use the newpyobj.escape_string()
andpyobj.escape_bytea()
functions. For example, code containing:should be adjusted to use:
References