Jeff Davis <pgsql@xxxxxxxxxxx> writes: > You can set standard_conforming_strings in postgresql.conf at any time > and reload the config, changing the value for all active connections. > That means that if a client opens a connection, and you SIGHUP postgres, > and then the client issues a PQescapeStringConn, the client will get an > incorrectly-escaped string. The window for this is pretty narrow, because PQescapeStringConn will use the latest-delivered parameter status, but it's certainly true that randomly changing standard_conforming_strings wouldn't be a bright idea. Probably a documentation note recommending against changing it via SIGHUP would be sufficient. > This could be a security vulnerability. Webservers which hold open > connections for long periods of time could be incorrectly escaping > values for long periods of time Not if they're using PQescapeStringConn. Handmade escaping code that thinks it needn't recheck the status could be at risk ... but realistically, handmade escaping code is likely already broken by the mere existence of standard_conforming_strings. regards, tom lane
