Re: Protection from SQL injection

From: Gregory Stark <stark(at)enterprisedb(dot)com>
To: <josh(at)agliodbs(dot)com>
Cc: <pgsql-hackers(at)postgresql(dot)org>, "Andrew Sullivan" <ajs(at)commandprompt(dot)com>
Subject: Re: Protection from SQL injection
Date: 2008-04-30 01:02:30
Message-ID: 87zlrcf93t.fsf@oxford.xeocode.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

"Josh Berkus" <josh(at)agliodbs(dot)com> writes:

>> (I sort of like the
>> suggestion up-thread, myself, which is to have a GUC that disables
>> multi-statement commands.  That'd probably cover a huge number of
>> cases, and combined with some sensible quoting rules in client
>> libraries, would quite possibly be enough.)
>
> MySQL did this already.

Did you guys miss Tom's comment up-thread? Postgres already does this if you
use PQExecParams().

--
Gregory Stark
EnterpriseDB http://www.enterprisedb.com
Ask me about EnterpriseDB's Slony Replication support!

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Gregory Stark 2008-04-30 01:17:42 Re: [HACKERS] Proposed patch - psql wraps at window width
Previous Message Gurjeet Singh 2008-04-30 00:47:03 Re: Protection from SQL injection