{"Entry":{"collection":"guc","key":"backslash_quote","name":"backslash_quote","aliases":[],"metadata":{"baseline":true,"boot_human":"Not specified","boot_val":null,"category":"Version and Platform Compatibility / Previous PostgreSQL Versions","category_zh":"","changed_in":[],"changes":[{"documentation_changed":true,"fields":{},"from":"8.1","status":"changed","to":"8.2"},{"documentation_changed":true,"fields":{},"from":"8.4","status":"changed","to":"9.0"},{"documentation_changed":true,"fields":{},"from":"13","status":"changed","to":"14"},{"documentation_changed":true,"fields":{},"from":"18","status":"changed","to":"19"}],"content_hash":"de35baad13d510c258ce792631ee55494600dca0b47a43bc76e26e6f4aa16160","context":"","default_changed_in":[],"default_history":[{"from":"9.0","to":"19","value":"safe_encoding"}],"derived_content_hash":"824f2ca011991c95d84d39469509ac5d5632378cadde62ceedebc086f0158b35","editorial":{"advice":{"olap":"Regression-test ETL, generated SQL, and old drivers, where parsing/quoting assumptions hide. Performance is rarely a reason to change this switch.","oltp":"Keep the modern default and repair legacy clients/SQL that depend on backslash_quote. Test migration at session scope first; do not make a compatibility switch permanent cluster policy.","small":"Keep the default without a legacy requirement. If temporarily enabled, record owner, affected connections, and a removal date."},"mechanism":["Sets whether \"\\'\" is allowed in string literals. It can be changed at session scope, so different sessions may observe different behavior.","The safe_encoding mode accepts \\' only when the client encoding cannot contain a backslash byte inside a multibyte character. This defense belongs to old string-literal syntax; E'...' is the explicit escape-string form and standard_conforming_strings governs ordinary strings.","Monitor and change backslash_quote together with array_nulls, escape_string_warning, standard_conforming_strings. Validate on the relevant server role and real workload, then use its user context to choose session change, reload, or restart; a historical boot default is not the current effective value."],"pitfalls":["Keeping a compatibility switch permanently instead of fixing the client.","Testing in one session and deploying globally to unrelated applications.","Confusing parsing compatibility with data or security compatibility.","Forgetting to remove an override after the upgrade migration is complete."],"references":[{"title":"PostgreSQL 19 Beta 4: backslash_quote","url":"https://www.postgresql.org/docs/19/runtime-config-compatible.html#GUC-BACKSLASH-QUOTE"},{"title":"PostgreSQL 19 release notes","url":"https://www.postgresql.org/docs/19/release-19.html"}],"related":["array_nulls","escape_string_warning","standard_conforming_strings","transform_null_equals","quote_all_identifiers","default_with_oids"],"summary":"backslash_quote — Sets whether \"\\'\" is allowed in string literals. Observed in PG9.0–19 Beta 4; its last measured boot default is safe_encoding in PG19 Beta 4, with user context. This is a beta-snapshot fact and can change before PostgreSQL 19 GA."},"enumvals":[],"first_version":"7.4","group":"Version and Platform Compatibility","group_slug":"compatible","imported_at":"2026-09-27T17:57:30.860727+08:00","intro_commit":{},"key":"backslash_quote","last_version":"20","max_val":"","min_val":"","name":"backslash_quote","position":39,"present_in":["7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.1","9.2","9.3","9.4","9.5","9.6","10","11","12","13","14","15","16","17","18","19","20"],"repair_provenance":{"original_source_revision":"english-manuals:4bd2144128de25d36742fcdfa375bf0f8b9ffff0865b58df98c7390bb8062647","receipt_sha256":"e4550eba7c70401f9551d9e071b1cffedd0c05e07cfdde419b4d259afdfd4335","repair":"wiki-repair-20261023"},"short_desc":"This controls whether a quote mark can be represented by \\' in a string literal.","short_desc_zh":"","source_rev":"wiki-repair-20261023:6561bff3f3ab9b8d3389d4111dbd5929ddaa3b0ab3fd47bc18e708864438f6e0","unit":"","vartype":"enum"}},"Definition":{"Collection":"guc","Key":"backslash_quote","SourceDatabase":"center","Version":"18","SourceTable":"guc","SourceKey":"backslash_quote","SourceRevision":"wiki-repair-20261023:6561bff3f3ab9b8d3389d4111dbd5929ddaa3b0ab3fd47bc18e708864438f6e0","Facts":{"boot_val":"safe_encoding","category":"Version and Platform Compatibility / Previous PostgreSQL Versions","context":"user","description":"This controls whether a quote mark can be represented by \\' in a string literal. The preferred, SQL-standard way to represent a quote mark is by doubling it ('') but PostgreSQL has historically also accepted \\'. However, use of \\' creates security risks because in some client character set encodings, there are multibyte characters in which the last byte is numerically equivalent to ASCII \\. If client-side code does escaping incorrectly then an SQL-injection attack is possible. This risk can be prevented by making the server reject queries in which a quote mark appears to be escaped by a backslash. The allowed values of backslash_quote are on (allow \\' always), off (reject always), and safe_encoding (allow only if client encoding does not allow ASCII \\ within a multibyte character). safe_encoding is the default setting. Note that in a standard-conforming string literal, \\ just means \\ anyway. This parameter only affects the handling of non-standard-conforming literals, including escape string syntax (E'...').","description_zh":"这个参数控制字符串字面量中的单引号是否能够用\\' 来表示。首选的 SQL 标准的方法是将其双写（''），但是 PostgreSQL 在历史上也接受\\'。不过使用\\' 容易导致安全风险，因为在某些客户端字符集编码中，有多字节字符的最后一个字节在数值上等价于 ASCII 的\\。如果客户端代码没有做到正确转义，那么就可能遭到 SQL 注入攻击。如果服务器拒绝看起来带有被反斜线转义的单引号的查询，那么就可以避免这种风险。backslash_quote 的可用值是 on（总是允许\\'）、off（总是拒绝）以及 safe_encoding（只有客户端编码不允许在多字节字符中存在 ASCII \\ 时允许）。safe_encoding 是默认设置。 注意在符合标准的字符串字面量中，\\ 就表示\\。这个参数只影响不符合标准的字面量的处理，包括转义字符串语法（E'...'）。","description_zh_html":"\u003cp\u003e\n        这个参数控制字符串字面量中的单引号是否能够用\u003ccode class=\"literal\"\u003e\\'\u003c/code\u003e 来表示。首选的 SQL 标准的方法是将其双写（\u003ccode class=\"literal\"\u003e''\u003c/code\u003e），但是 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 在历史上也接受\u003ccode class=\"literal\"\u003e\\'\u003c/code\u003e。不过使用\u003ccode class=\"literal\"\u003e\\'\u003c/code\u003e 容易导致安全风险，因为在某些客户端字符集编码中，有多字节字符的最后一个字节在数值上等价于 ASCII 的\u003ccode class=\"literal\"\u003e\\\u003c/code\u003e。如果客户端代码没有做到正确转义，那么就可能遭到 SQL 注入攻击。如果服务器拒绝看起来带有被反斜线转义的单引号的查询，那么就可以避免这种风险。\u003ccode class=\"varname\"\u003ebackslash_quote\u003c/code\u003e 的可用值是 \u003ccode class=\"literal\"\u003eon\u003c/code\u003e（总是允许\u003ccode class=\"literal\"\u003e\\'\u003c/code\u003e）、\u003ccode class=\"literal\"\u003eoff\u003c/code\u003e（总是拒绝）以及 \u003ccode class=\"literal\"\u003esafe_encoding\u003c/code\u003e（只有客户端编码不允许在多字节字符中存在 ASCII \u003ccode class=\"literal\"\u003e\\\u003c/code\u003e 时允许）。\u003ccode class=\"literal\"\u003esafe_encoding\u003c/code\u003e 是默认设置。\n       \u003c/p\u003e\u003cp\u003e\n        注意在符合标准的字符串字面量中，\u003ccode class=\"literal\"\u003e\\\u003c/code\u003e 就表示\u003ccode class=\"literal\"\u003e\\\u003c/code\u003e。这个参数只影响不符合标准的字面量的处理，包括转义字符串语法（\u003ccode class=\"literal\"\u003eE'...'\u003c/code\u003e）。\n       \u003c/p\u003e","doc":{"anchor":"GUC-BACKSLASH-QUOTE","file":"runtime-config-compatible.html","lang":"en","sha256":"db2ecac1e62738d66a4932f4c8197976a349bcbf261c5b90fff740bc44867b8b","slug":"18"},"documented":true,"enumvals":["safe_encoding","on","off"],"extra_desc":null,"lang":"en","max_val":null,"metadata_version":"18","min_val":null,"name":"backslash_quote","short_desc":"Sets whether \"\\'\" is allowed in string literals.","source":"pg-settings-source-snapshot","translation_provenance":{"inputs":[{"kind":"current-pgdoc-translation","path":"/Users/vonng/pgsty/pgdoc/zh/18/html/runtime-config-compatible.html","sha256":"01995ca3dfa6387ea699463dba924add2367e9a7fc4b9b43c1610c233e5e014b"}],"kind":"same-version-pgdoc","locale":"zh-Hans","source_revision":"b1b500221dbe5437cfca004d6b04d3f6e422765d","version":"18"},"unit":null,"vartype":"enum","zh_from":"same-version-pgdoc"},"ManualEvidence":{"doc":{"anchor":"GUC-BACKSLASH-QUOTE","file":"runtime-config-compatible.html","lang":"en","sha256":"db2ecac1e62738d66a4932f4c8197976a349bcbf261c5b90fff740bc44867b8b","slug":"18"}},"MeasuredEvidence":{"metadata_version":"18"}},"Text":{"Collection":"guc","Key":"backslash_quote","SourceDatabase":"center","Version":"18","Locale":"en","Title":"backslash_quote","Summary":"This controls whether a quote mark can be represented by \\' in a string literal. The preferred, SQL-standard way to represent a quote mark is by doubling it ('') but PostgreSQL has historically also accepted \\'. However, use of \\' creates security risks because in some client character set encodings, there are multibyte characters in which the last byte is numerically equivalent to ASCII \\. If client-side code does escaping incorrectly then an SQL-injection attack is possible. This risk can be prevented by making the server reject queries in which a quote mark appears to be escaped by a backslash. The allowed values of backslash_quote are on (allow \\' always), off (reject always), and safe_encoding (allow only if client encoding does not allow ASCII \\ within a multibyte character). safe_encoding is the default setting. Note that in a standard-conforming string literal, \\ just means \\ anyway. This parameter only affects the handling of non-standard-conforming literals, including escape string syntax (E'...').","BodyHTML":"\u003cp\u003eThis controls whether a quote mark can be represented by \\\u0026#39; in a string literal. The preferred, SQL-standard way to represent a quote mark is by doubling it (\u0026#39;\u0026#39;) but PostgreSQL has historically also accepted \\\u0026#39;. However, use of \\\u0026#39; creates security risks because in some client character set encodings, there are multibyte characters in which the last byte is numerically equivalent to ASCII \\. If client-side code does escaping incorrectly then an SQL-injection attack is possible. This risk can be prevented by making the server reject queries in which a quote mark appears to be escaped by a backslash. The allowed values of backslash_quote are on (allow \\\u0026#39; always), off (reject always), and safe_encoding (allow only if client encoding does not allow ASCII \\ within a multibyte character). safe_encoding is the default setting. Note that in a standard-conforming string literal, \\ just means \\ anyway. This parameter only affects the handling of non-standard-conforming literals, including escape string syntax (E\u0026#39;...\u0026#39;).\u003c/p\u003e","SourceRevision":"wiki-repair-20261023:6561bff3f3ab9b8d3389d4111dbd5929ddaa3b0ab3fd47bc18e708864438f6e0","ContentHash":"1a25c8b35c6428c0e760a0104f1bc69cffcdfde8264dbf6588f627bddde84cfe","Payload":{"description":"This controls whether a quote mark can be represented by \\' in a string literal. The preferred, SQL-standard way to represent a quote mark is by doubling it ('') but PostgreSQL has historically also accepted \\'. However, use of \\' creates security risks because in some client character set encodings, there are multibyte characters in which the last byte is numerically equivalent to ASCII \\. If client-side code does escaping incorrectly then an SQL-injection attack is possible. This risk can be prevented by making the server reject queries in which a quote mark appears to be escaped by a backslash. The allowed values of backslash_quote are on (allow \\' always), off (reject always), and safe_encoding (allow only if client encoding does not allow ASCII \\ within a multibyte character). safe_encoding is the default setting. Note that in a standard-conforming string literal, \\ just means \\ anyway. This parameter only affects the handling of non-standard-conforming literals, including escape string syntax (E'...')."}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20","7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.1","9.2","9.3","9.4","9.5","9.6"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}