PyGreSQL 3.8 did not use PostgreSQL’s safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escapestring() and pg.escapebytea() are still available, but applications will have to be adjusted to use the new pyobj.escapestring() and pyobj.escapebytea() functions. For example, code containing:

python import pg connection = pg.connect(...) escaped = pg.escapestring(untrustedinput) should be adjusted to use:

python import pg connection = pg.connect(...) escaped = connection.escapestring(untrustedinput)