Parameter · Version and Platform Compatibility / Previous PostgreSQL Versions
backslash_quote
Sets whether "\'" is allowed in string literals.
- Default:
safe_encoding - Type: enum
- Values: safe_encoding · on · off
- Applies: Session (any user)
In plain words
The standard way to put a quote inside a string is to double it: 'it''s'. Old code sometimes writes 'it\'s' instead. In some client-only multibyte encodings, an attacker can hide a byte before the backslash so it is consumed as part of a character, which ends the string early: a classic SQL injection. This setting controls whether \' is accepted.
For DBAs and operators
Only matters where backslash is an escape character: E'…' strings, and ordinary strings when standard_conforming_strings is off. Values:
safe_encoding(default): allowed only if the client encoding does not let a backslash appear inside a multibyte character (UTF8, LATIN1 … are safe; SJIS, BIG5, GBK, GB18030 are not).on: always allowed (unsafe with those encodings).off: always rejected.
Verified on 18.6 (with standard_conforming_strings = off, backslash_quote = off):
ERROR: unsafe use of \' in a string literal
HINT: Use '' to write quotes in strings. \' is insecure in client-only encodings.
Applications should always use parameter binding or quote_literal() / format('%L') rather than hand-escaping.
How to change it
Any user can change it for their session with SET.
Related parameters
standard_conforming_strings escape_string_warning client_encoding