Avoiding SQL injection in Dynamic Queries (in plpgsql)

From: Allan Kamau <kamauallan(at)gmail(dot)com>
To: Postgres General Postgres General <pgsql-general(at)postgresql(dot)org>
Subject: Avoiding SQL injection in Dynamic Queries (in plpgsql)
Date: 2010-03-17 08:12:32
Message-ID: ab1ea6541003170112x5699faan2fb525747c089f54@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

When writing dynamic commands (those having "EXECUTE 'some SQL
query';), is there a way to prevent interpretation of input parameters
as pieces of SQL commands? Does quote_literal() function implicitly
protect against this unwanted behaviour.

Allan.

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Craig Ringer 2010-03-17 08:41:15 Re: Avoiding SQL injection in Dynamic Queries (in plpgsql)
Previous Message A. Kretschmer 2010-03-17 06:03:24 Re: return row from plpgsql?