Skip site navigation (1) Skip section navigation (2)

Re: Protection from SQL injection

From: "Jaime Casanova" <systemguards(at)gmail(dot)com>
To: "Thomas Mueller" <thomas(dot)tom(dot)mueller(at)gmail(dot)com>
Cc: pgsql-sql(at)postgresql(dot)org
Subject: Re: Protection from SQL injection
Date: 2008-04-26 21:31:46
Message-ID: c2d9e70e0804261431y6f25f783hf5d43121749b7aba@mail.gmail.com (view raw or flat)
Thread:
Lists: pgsql-sql
On Sat, Apr 26, 2008 at 1:19 PM, Thomas Mueller
<thomas(dot)tom(dot)mueller(at)gmail(dot)com> wrote:
> Hi,
>
> >  > The 'ALLOW_LITERALS NONE' mode is enabled by the developer itself, or
> >  > by an administrator.
> >  then it solves nothing...
> >  what if the developer never SET ALLOW_LITERALS NONE
>
> As I have said, the 'ALLOW_LITERALS NONE' mode is enabled by the
> developer itself, or by an administrator. The developer may be lazy,
> but the administrator can enforce this policy.
>

but can't the developer allow literals again?

> >  maybe i can inject "select * from tab where intcol = intcol; set
> >  allow_literals all; add any query you want"
>
> How do you inject this? How would the application looks like where
> this can be injected?
>

ok... point taken

-- 
regards,
Jaime Casanova
Soporte de PostgreSQL
Guayaquil - Ecuador
Cel. (593) 087171157

In response to

Responses

pgsql-sql by date

Next:From: Thomas KellererDate: 2008-04-26 21:32:58
Subject: Re: Protection from SQL injection
Previous:From: Thomas MuellerDate: 2008-04-26 18:19:40
Subject: Re: Protection from SQL injection

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group