Re: discrepancy between SPARQL and Turtle

On May 13, 2026, at 2:56 AM, Andy Seaborne <andy@apache.org> wrote:
> 
> SPARQL 1.1 is over 10 years ago. AIUI A "maintenance and new features" mode for a working group isn't any more permissive for such a change.
> 
> As it has security implications so I hope it is in-scope for the WG similar to an errata.
> 
> We could make the change and add text:
> 
> * Version 1.0 and 1.1 of SPARQL accepted numeric escape sequences anywhere in the SPARQL request string.
> * Implementations MAY accept such input, being aware of the issues this has.
> * Systems MUST (or SHOULD?) produce text that only uses numeric escape sequences in URIs and literal lexical forms.

I worry that this isn’t a good solution. I see two problems with only accepting the escapes in URIs and literals:

1. As currently specified, the un-escaping happens before parsing, so depending on the APIs being used, it can be very hard to tell if an escape is in a URI or literal.
2. I think this would still leave the 1-char vs. 2-char issue as described previously. Just having the escapes in a literal wouldn’t change the fact that the same sequence would be expected to produce 1 char in SPARQL but 2 chars in Turtle. I would much prefer a full fix that aligned SPARQL with the semantics of Turtle, but that is a big change as it requires updating the grammar and introduces backwards incompatibility.

As I said, I agree that this is a major problem. But I’m concerned that the full fix would be a backwards incompatible change introduced very late in the WG process. I can get over that concern if we’re confident it’s acceptable under our charter and there is broad agreement, but thought it was worth raising.

.greg

Received on Wednesday, 13 May 2026 13:56:34 UTC