736

I have a table test(id,name).

I need to insert values like: user's log, 'my user', customer's.

 insert into test values (1,'user's log');
 insert into test values (2,''my users'');
 insert into test values (3,'customer's');

I am getting an error if I run any of the above statements.

If there is any method to do this correctly please share. I don't want any prepared statements.

Is it possible using sql escaping mechanism?

5
  • 1
    Use whatever value escaping your client library provides. For more information you'll have to say how you're accessing the database. Sep 7, 2012 at 11:13
  • @Richard Huxton database is accessed by java.
    – MAHI
    Sep 7, 2012 at 11:16
  • 2
    So use the standard jdbc placeholders. Or explain why that's not the best choice. Sep 7, 2012 at 11:23
  • 1
    @Richard Huxton i am not saying that's not best choice, i am searching if their exists any escaping method in sql to do so.
    – MAHI
    Sep 7, 2012 at 11:26
  • Well, see @Claudix's reply below, but obviously value literals will need different escaping depending on their type postgresql.org/docs/current/static/datatype.html Sep 7, 2012 at 11:30

8 Answers 8

1249

String literals

Escaping single quotes ' by doubling them up → '' is the standard way and works of course:

'user's log'     -- incorrect syntax (unbalanced quote)
'user''s log'

Plain single quotes (ASCII / UTF-8 code 39), mind you, not backticks `, which have no special purpose in Postgres (unlike certain other RDBMS) and not double-quotes ", used for identifiers.

In old versions or if you still run with standard_conforming_strings = off or, generally, if you prepend your string with E to declare Posix escape string syntax, you can also escape with the backslash \:

E'user\'s log'

Backslash itself is escaped with another backslash. But that's generally not preferable.
If you have to deal with many single quotes or multiple layers of escaping, you can avoid quoting hell in PostgreSQL with dollar-quoted strings:

'escape '' with '''''
$$escape ' with ''$$

To further avoid confusion among dollar-quotes, add a unique token to each pair:

$token$escape ' with ''$token$

Which can be nested any number of levels:

$token2$Inner string: $token1$escape ' with ''$token1$ is nested$token2$

Pay attention if the $ character should have special meaning in your client software. You may have to escape it in addition. This is not the case with standard PostgreSQL clients like psql or pgAdmin.

That is all very useful for writing PL/pgSQL functions or ad-hoc SQL commands. It cannot alleviate the need to use prepared statements or some other method to safeguard against SQL injection in your application when user input is possible, though. @Craig's answer has more on that. More details:

Values inside Postgres

When dealing with values inside the database, there are a couple of useful functions to quote strings properly:

  • quote_literal() or quote_nullable() - the latter outputs the unquoted string NULL for null input.
    There is also quote_ident() to double-quote strings where needed to get valid SQL identifiers.
  • format() with the format specifier %L is equivalent to quote_nullable().
    Like: format('%L', string_var)
  • concat() or concat_ws() are typically no good for this purpose as those do not escape nested single quotes and backslashes.
11
  • 2
    It's also worth noting that some PgJDBC versions have issues with dollar-quoting - in particular, it may fail to ignore statement-terminators (;) within dollar-quoted strings. Apr 7, 2014 at 8:10
  • 1
    This related answer has details for the problem with JDBC. Apr 7, 2014 at 12:56
  • 1
    And if u want to escape s'tring from text column on insertion in case of procedural language etc, then you can use quote_literal(column_name) string function.
    – alexglue
    Apr 9, 2014 at 9:59
  • @ErwinBrandstetter, re "can be nested any number of levels": but SELECT $outer$OUT$inner$INNER$inner$ER$outer$; proves that 2nd level nesting does not work here.?
    – filiprem
    Apr 12, 2019 at 13:12
  • 1
    We've noticed that attempting to insert a string literal to Redshift (which is effectively old Postgres 8.x) matches what you said here about old versions. In that platform if a string literal has a backslash which doesn't combine to a valid escape sequence with the following character, that backslash just disappears when inserted, so doubling the backslashes works in that case too. You can easily get stung when loading xml/html literal values. Literal used to mean (and still does in Redshift) literal with escaping. Nice that you have to explicitly request that behaviour now with E.
    – Davos
    May 3, 2019 at 1:26
64

According to PostgreSQL documentation (4.1.2.1. String Constants):

To include a single-quote character within a string constant, write two adjacent single quotes, e.g. 'Dianne''s horse'.

See also the standard_conforming_strings parameter, which controls whether escaping with backslashes works.

2
  • thanks for reply, but i have to manually escape each char by using this, if their exists any built in functions for doing this ?
    – MAHI
    Sep 7, 2012 at 11:27
  • 3
    @MAHI If there were such a function, it would be in PgJDBC, not in PostgreSQL its self, because the escaping must be done on the client-side. There is no such documented public function because it's a terrible idea. You should be using parameterised statements so you don't need to do any kind of potentially unreliable escaping. Sep 7, 2012 at 11:47
55

This is so many worlds of bad, because your question implies that you probably have gaping SQL injection holes in your application.

You should be using parameterized statements. For Java, use PreparedStatement with placeholders. You say you don't want to use parameterised statements, but you don't explain why, and frankly it has to be a very good reason not to use them because they're the simplest, safest way to fix the problem you are trying to solve.

See Preventing SQL Injection in Java. Don't be Bobby's next victim.

There is no public function in PgJDBC for string quoting and escaping. That's partly because it might make it seem like a good idea.

There are built-in quoting functions quote_literal and quote_ident in PostgreSQL, but they are for PL/PgSQL functions that use EXECUTE. These days quote_literal is mostly obsoleted by EXECUTE ... USING, which is the parameterised version, because it's safer and easier. You cannot use them for the purpose you explain here, because they're server-side functions.


Imagine what happens if you get the value ');DROP SCHEMA public;-- from a malicious user. You'd produce:

insert into test values (1,'');DROP SCHEMA public;--');

which breaks down to two statements and a comment that gets ignored:

insert into test values (1,'');
DROP SCHEMA public;
--');

Whoops, there goes your database.

9
  • 31
    I've often used literal inserts like this to bootstrap data, alongside DDL. Lets just try to answer questions than responses like 'ýou're doing it wrong' Nov 29, 2018 at 11:05
  • 10
    @ThatDataGuy fair comment, but in this question the OP added a comment saying database is accessed by java so this does directly address the question. It is also very important for people coming here to be made aware of the potential dangers, especially given SQL Injection is the #1 cause of software vulnerability. Once aware of the problem, people can make informed decisions as to when it doesn't matter, like your bootstrapping use-case.
    – Davos
    May 3, 2019 at 1:45
  • 7
    Exactly. People also copy&paste code a lot. I'll stop warning people about this the day I stop seeing SQL injection vulnerabilities daily in production code. May 6, 2019 at 4:11
  • 3
    This question & answer should be part of any incoming software developer's exams. OP operations "MAY BE SAFE", but it's really good to keep reminding even the most experienced people of the dangers. Feb 7, 2020 at 19:00
  • 3
    @Davos Agreed, people should be warned, but I don't think there should be a standalone warning-answer. It would be best to warn people with the following process: i) Write a comment on each answer asking the author to prefix their answer with a warning; ii) If the author doesn't update within 7 days, then you go in there and edit the answer with the preamble. Sep 23, 2020 at 3:15
40

In postgresql if you want to insert values with ' in it then for this you have to give extra '

 insert into test values (1,'user''s log');
 insert into test values (2,'''my users''');
 insert into test values (3,'customer''s');
2
  • 3
    upvote for showing the triple quotes if you have a quoted string
    – winkbrace
    Mar 17, 2020 at 15:36
  • up , as it is a simple solution
    – ktaria
    Apr 12, 2020 at 19:27
8

you can use the postrgesql chr(int) function:

insert into test values (2,'|| chr(39)||'my users'||chr(39)||');
2

If you need to get the work done inside Pg:

to_json(value)

https://www.postgresql.org/docs/9.3/static/functions-json.html#FUNCTIONS-JSON-TABLE

3
  • How is this question related to JSON? Dec 18, 2017 at 23:49
  • 1
    @ErwinBrandstetter , sorry, i might be off.. but it escapes quotes in strings
    – hatenine
    Dec 19, 2017 at 11:07
  • 1
    That's another matter altogether. You might use format(), quote_literal() or quote_nullable() for escaping quotes. See: stackoverflow.com/a/25143945/939860 Dec 19, 2017 at 15:10
1

When I used Python to insert values into PostgreSQL, I also met the question: column "xxx" does not exist.

The I find the reason in wiki.postgresql:

PostgreSQL uses only single quotes for this (i.e. WHERE name = 'John'). Double quotes are used to quote system identifiers; field names, table names, etc. (i.e. WHERE "last name" = 'Smith').
MySQL uses ` (accent mark or backtick) to quote system identifiers, which is decidedly non-standard.

It means PostgreSQL can use only single quote for field names, table names, etc. So you can not use single quote in value.

My situation is: I want to insert values "the difference of it’s adj for sb and it's adj of sb" into PostgreSQL.

How I figure out this problem:

I replace ' with , and I replace " with '. Because PostgreSQL value does not support double quote.

So I think you can use following codes to insert values:

 insert into test values (1,'user’s log');
 insert into test values (2,'my users');
 insert into test values (3,'customer’s');
2
  • 1
    "It means PostgreSQL can use only single quote for field names, table name" no, you can not use single quotes ' for column or table names. Neither in Postgres nor in standard SQL. And you can easily embed a single quote in a string constant user''s log' which is how this is defined in the SQL standard.
    – user330315
    Oct 29, 2021 at 15:44
  • @a_horse_with_no_name Thanks for your solution. I find it works after testing.
    – Wonz
    Oct 29, 2021 at 16:00
-1

You must have to add an extra single quotes -> ' and make doubling quote them up like below examples -> ' ' is the standard way and works of course:

Wrong way: 'user's log'
Right way: 'user''s log'

problem:

insert into test values (1,'user's log');
insert into test values (2,''my users'');
insert into test values (3,'customer's');

Solutions:

insert into test values (1,'user''s log');
insert into test values (2,'''my users''');
insert into test values (3,'customer''s');
2
  • What does this add over existing answers? Dec 21, 2022 at 6:49
  • Hi @ErwinBrandstetter, I rearrange the Answer in an organized way for a better understanding. May I be wrong anyway? or My this answer wrong? Dec 21, 2022 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.