Re: Sql injection attacks

> MH> If you use the parametrised formats, e.g.
> MH> "SELECT * FROM foo WHERE bar=(at)bar"
> MH> or just "sp_foo" in the case of the stored procedure (the driver
> MH> will pick up parameter names automatically)
>
> Are you saying that "@bar" is part of the Postgres query
> syntax? If it is, I can't find it in the 7.4 docs. What do
> you mean by "the parameterised formats"? I would appreciate a
> clarification and the URL of the relevant documentation.

Sorry, this is the ADO syntax used in ASP - I was referring to the
incorrect claims about MSSQL you had found. It definitly applies to
MSSQL on ASP, not 100% sure about pgsql on ASP.

Another common syntax is the "?" syntax, e.g. "SELECT * FROM foo EBRE
bar=?", that's used in for example DBI.

So it depends on what interface you are using to connect to the server.
If it's straight libpq, you should look at PQexecParams() or
PQexecPrepared(), see
http://www.postgresql.org/docs/7.4/static/libpq-exec.html.

//Magnus