lib/client.js

@@ -39,11 +39,12 @@ var Client = function(config) {
   this.connection = c.connection || new Connection({
     stream: c.stream,
     ssl: this.connectionParameters.ssl,
-    keepAlive: c.keepAlive || false
+    keepAlive: c.keepAlive || false,
+    client_encoding: this.connectionParameters.client_encoding || 'utf8',
   });
   this.queryQueue = [];
   this.binary = c.binary || defaults.binary;
-  this.encoding = 'utf8';
+  this.encoding = this.connectionParameters.client_encoding || 'utf8';
   this.processID = null;
   this.secretKey = null;
   this.ssl = this.connectionParameters.ssl || false;

lib/connection.js

@@ -39,7 +39,7 @@ var Connection = function(config) {
   this.lastOffset = 0;
   this.buffer = null;
   this.offset = null;
-  this.encoding = 'utf8';
+  this.encoding = config.client_encoding || 'utf8';
   this.parsedStatements = {};
   this.writer = new Writer();
   this.ssl = config.ssl || false;

lib/result.js

@@ -7,6 +7,7 @@
  */
 
 var types = require('pg-types');
+var escape = require('js-string-escape');
 
 //result object returned from query
 //in the 'end' event and also
@@ -75,13 +76,13 @@ Result.prototype.addRow = function(row) {
 
 var inlineParser = function(fieldName, i) {
   return "\nthis['" +
-    //fields containing single quotes will break
-    //the evaluated javascript unless they are escaped
-    //see https://github.com/brianc/node-postgres/issues/507
-    //Addendum: However, we need to make sure to replace all
-    //occurences of apostrophes, not just the first one.
-    //See https://github.com/brianc/node-postgres/issues/934
-    fieldName.replace(/'/g, "\\'") +
+    // fields containing single quotes will break
+    // the evaluated javascript unless they are escaped
+    // see https://github.com/brianc/node-postgres/issues/507
+    // Addendum: However, we need to make sure to replace all
+    // occurences of apostrophes, not just the first one.
+    // See https://github.com/brianc/node-postgres/issues/934
+    escape(fieldName) +
     "'] = " +
     "rowData[" + i + "] == null ? null : parsers[" + i + "](rowData[" + i + "]);";
 };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pg",
-  "version": "6.3.1",
+  "version": "6.3.3",
   "description": "PostgreSQL client - pure javascript & libpq with the same API",
   "keywords": [
     "postgres",
@@ -20,6 +20,7 @@
   "dependencies": {
     "buffer-writer": "1.0.1",
     "packet-reader": "0.3.1",
+    "js-string-escape": "1.0.1",
     "pg-connection-string": "0.1.3",
     "pg-pool": "1.*",
     "pg-types": "1.*",

test/integration/client/field-name-escape-tests.js

@@ -0,0 +1,10 @@
+var pg = require('./test-helper').pg
+
+var sql = 'SELECT 1 AS "\\\'/*", 2 AS "\\\'*/\n + process.exit(-1)] = null;\n//"'
+
+var client = new pg.Client()
+client.connect()
+client.query(sql, function (err, res) {
+  if (err) throw err
+  client.end()
+})