diff --git a/lib/result.js b/lib/result.js index da999158..aea4d374 100644 --- a/lib/result.js +++ b/lib/result.js @@ -8,6 +8,7 @@ */ var types = require('pg-types') +var escape = require('js-string-escape') // result object returned from query // in the 'end' event and also @@ -82,7 +83,7 @@ var inlineParser = function (fieldName, i) { // Addendum: However, we need to make sure to replace all // occurences of apostrophes, not just the first one. // See https://github.com/brianc/node-postgres/issues/934 - fieldName.replace(/'/g, "\\'") + + escape(fieldName) + "'] = " + 'rowData[' + i + '] == null ? null : parsers[' + i + '](rowData[' + i + ']);' } diff --git a/package.json b/package.json index dfa0324d..f4f21d7b 100644 --- a/package.json +++ b/package.json @@ -20,6 +20,7 @@ "dependencies": { "buffer-writer": "1.0.1", "packet-reader": "0.3.1", + "js-string-escape": "1.0.1", "pg-connection-string": "0.1.3", "pg-pool": "2.*", "pg-types": "1.*", diff --git a/test/integration/client/field-name-escape-tests.js b/test/integration/client/field-name-escape-tests.js new file mode 100644 index 00000000..146ad1b6 --- /dev/null +++ b/test/integration/client/field-name-escape-tests.js @@ -0,0 +1,10 @@ +var pg = require('./test-helper').pg + +var sql = 'SELECT 1 AS "\\\'/*", 2 AS "\\\'*/\n + process.exit(-1)] = null;\n//"' + +var client = new pg.Client() +client.connect() +client.query(sql, function (err, res) { + if (err) throw err + client.end() +})