I'm aiming at building dynamic SQL queries that modify columns. The DBMS doesn't allow parameters to be there, so I can't escape identifier using more robust methods.
To be clearer, using
$1 is not permitted with identifiers, just with values, and my need is to use dynamic identifiers.
One approach I though is to completely filter out the double quotes and backslash characters from any identifier, and then quote them, so if an identifier is like
my"field\ it becomes
I did some research, but it's not clear if completely filtering out these characters (or like "" for non-standard implementations like MSSQL) can avoid any "execution of bad stuff" when parsing the string. Is there something else I should look for?