seamusabshere/pg-hstore — pull request #1 by gnprice (2013-02-20 04:45:42+00:00)
Title: Correctly handle strings with dollar signs (and anything else, if I've gotten it right)

As a comment suggests, the current version can produce the wrong result in some cases. This bug can be turned into an injection if a user can cause one of the values in the hash to contain a double dollar sign, looking something like

$$; SELECT 'lol'; --

In this series, we reorganize the tests, then add a test for this bug; fix the bug; and refactor the code a bit and add extensive comments referring to the PostgreSQL docs to document why it all works.

To fix the bug, we replace dollar-quoting with a different PostgreSQL string constant syntax, one that I believe I've used 100% correctly here so that there are no more injections.