Re: Protection from SQL injection

From: Joe <dev(at)freedomcircle(dot)net>
To: Ivan Sergio Borgonovo <mail(at)webthatworks(dot)it>
Cc: pgsql-sql(at)postgresql(dot)org
Subject: Re: Protection from SQL injection
Date: 2008-04-27 18:25:06
Message-ID: 4814C502.7070604@freedomcircle.net
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-sql

Ivan Sergio Borgonovo wrote:
> That's better than nothing but it is still a lot of code duplication.
> You've to write column names in the sql statement and in the array
> and... column values are not contextual to the statement.
>

The apparent duplication in the example stems for its tutorial nature.
In a real program, the namedict "array" (it's actually a Python
tuple--an immutable array) would normally be constructed
programmatically from user or other input. Note also that although
Joshua chose to use dictionary keys named identical to the PG column
names, they could be named differently, like "first" and "last".
> That's easy... while what I wrote above does look as requiring a
> really special parser.
>
> Furthermore from the example it looks as if all this is going to
> miss the scope to prevent sql injection since it doesn't support
> prepared statements.
>

I assume you didn't check the PEP 249
(http://www.python.org/dev/peps/pep-0249/). The execute() and
executemany() Cursor object methods are precisely to prepare and execute
database operations.

Joe

In response to

Browse pgsql-sql by date

  From Date Subject
Next Message Thomas Mueller 2008-04-27 18:43:32 Re: Protection from SQL injection
Previous Message Ivan Sergio Borgonovo 2008-04-27 17:18:40 Re: Protection from SQL injection