fix pgsql

sorry for the delay looking at this, i've been swamped with other things...

visually, the patch seems reasonable, it applies cleanly, and things seem to work fine on pgsql after i apply it. however, i don't see any errors *without* the patch on pgsql, so i can't verify that the patch solves a problem...

can you tell me exactly what bug (and how to see it) this patch fixes? i tried creating issues, following up, changing the meta data (assigned, component, etc), since it seems to be specific to follow-ups (comment.inc) and dealing with how we store/retrieve the issue's "data" blob, which is the serialized info for the meta data... no errors on the screen, in the watchdog, or in the pgsql log itself. :(

anyway, i'll probably commit this anyway, but it'd be nice to know exactly what the problem is, first. ;)

thanks,
-derek

I'm using this module on drupal 5 in php4+pg7.4, and also on php5+pg8.2
I haven't seen any issues.

What errors were you getting before the patch?

Changing the insert to %b makes sense because the data is blob in the tabel defs
but why copy to ->data ?

What version of postgreql are you using?

indeed.

warning: pg_query() [function.pg-query]: Query failed: ERROR: invalid input syntax for type bytea in /home/brenda/drupal-5.1/includes/database.pgsql.inc on line 125.
user warning: query: INSERT INTO project_comments (cid, nid, uid, created, changed, body, data, file_path, file_mime, file_size) VALUES (2, 27, 1, 1177744194, 1177744194, 'this is a slash ///// this is a back slash \\\\\\\\\\', 'N;', '', '', 0) in /home/brenda/drupal-5.1/includes/database.pgsql.inc on line 144.

dww - confirmed this is a SQL injection hole...

luckily, i just happened to have logged on 10 minutes after the previous comment, so i immediately unpublished this issue. after extensive review and testing on both mysql and pgsql, this is a false alarm. there's no possiblity of SQL injection here (though i can finally reproduce the error on pgsql, that's helpful). ;) so, i'll make this issue public again. however, for future reference of anyone who happens to read this issue, (i already spoke with Shiny in IRC) never post suspected security bugs publically in the issue queue or forums on drupal.org, or in #drupal in IRC. if you find or suspect you've found a security vulnerability, send an email to security@drupal.org and wait for a reply from there.

thanks,
-derek

oh, further reading: http://drupal.org/node/32750

now that i could see the real bug, i re-tested on pgsql and mysql, and committed the patch to HEAD, DRUPAL-4-7--2 and DRUPAL-4-7. thanks!