copy_from doesn't handle specifying null character properly

Hi all,

I'll make it short:

cursor.copy_from(somefile, 'sometable')
works in cases where
cursor.copy_from(somefile, 'sometable', null='\\N')
doesn't.  This is in bzr trunk (or whatever head is called in bzr)


It does work with the following:

cursor.copy_from(somefile, 'sometable', null=r'\\N')
or 
cursor.copy_from(somefile, 'sometable', null='\\\\N')


psycopg2 sends the following to postgres (from the debug output):

 ...testsimple FROM stdin USING DELIMITERS ' ' WITH NULL AS '\N'

which postgres sort of interprets as N (eating the escape).  psycopg2
should escape the string before sending it to postgres.

In some possible configurations, this could be a security hole.  If
input from the user is passed to psycopg2 as the null parameter in the
very reasonable assumption that psycopg2 should escape those values,
something like null="'; <malicious code> where '' = '" would likely get
through.


_______________________________________________
Psycopg mailing list
[email protected]
http://lists.initd.org/mailman/listinfo/psycopg