From: <gh...@gh...> - 2006-06-07 17:40:27
|
I'll make it quick, but not *so* quick (accidentally sent a message a minute ago): Patch for a security hole in PostgreSQL (CVE-2006-2314): escaping quotes with backslashes is insecure. The change is to escape single quotes with another single quote: \' => ''. Thanks to Martin Pitt for the patch. Downloads (source, Windows binaries for Python 2.1, 2.2, 2.3, 2.4) at http://sourceforge.net/project/showfiles.php?group_id=16528&package_id=20458&release_id=423036 Cheers, -- Gerhard |