I'm aiming at building dynamic SQL queries that modify columns. The DBMS doesn't allow parameters to be there, so I can't escape identifier using more robust methods.

To be clearer, using ? or $1 is not permitted with identifiers, just with values, and my need is to use dynamic identifiers.

One approach I though is to completely filter out the double quotes and backslash characters from any identifier, and then quote them, so if an identifier is like my"field\ it becomes "myfield".

I did some research, but it's not clear if completely filtering out these characters (or like "[]" for non-standard implementations like MSSQL) can avoid any "execution of bad stuff" when parsing the string. Is there something else I should look for?


  • 4
    There's always more "bad stuff" than your filter can handle. – mustaccio Apr 12 at 16:44
  • That's the point, I have no idea if strange unicode sequences or malformed strings can harm the query or not. From the standpoint of a parser, if no escape sequences are found, there should be no risk, am I wrong? – John White Apr 12 at 17:22
  • 3
    What is wrong with using Binds? – Michael Kutz Apr 12 at 17:34
  • Why don't you show relevant parts of your code? – filiprem Apr 12 at 21:15
  • If by Binds you mean like "WHERE id = ?", it's because identifiers are not accepted as them. My need is to set dynamically field names. Code doesn't really seem relevant, though I could write an example, if needed. This is more about the parsing of strings – John White Apr 12 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.