| From: | Volkan YAZICI <yazicivo(at)ttnet(dot)net(dot)tr> |
|---|---|
| To: | "Uwe C(dot) Schroeder" <uwe(at)oss4u(dot)com> |
| Cc: | pgsql-general(at)postgresql(dot)org, hefferon9(at)adelphia(dot)net |
| Subject: | Re: SQL injection in a ~ or LIKE statement |
| Date: | 2006-10-23 07:19:13 |
| Message-ID: | 20061023071534.GA1363@alamut |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-general |
On Oct 22 02:33, Uwe C. Schroeder wrote:
> On Sunday 22 October 2006 12:32, Volkan YAZICI wrote:
> > If I were you, I'd ask psycopg2 developers to implement parameters that
> > are natively supported by PostgreSQL. With parameters, you won't mess up
> > with any escaping or injection related issue.
>
> psycopg2 supports parameters which are escaped properly.
You're wrong. psycopg uses Python style parameters and escapes the
specified input before inserting into query string. See documentation of
PQexecParams() for the "parameters" I mentioned. I think, you're
confusing terms. I just checked psycopg2 source code and couldn't see
any parameter implementation.
Regards.
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Alban Hertroys | 2006-10-23 07:42:54 | Re: Overload after some minutes, please help! |
| Previous Message | Joost Kraaijeveld | 2006-10-23 06:22:09 | Re: How to determine initdb parameters on old database? |