Re: Prepared Statements - Mailing list pgsql-jdbc

From Kim Ho
Subject Re: Prepared Statements
Date
Msg-id 1058548037.19658.159.camel@topanga.toronto.redhat.com
Whole thread Raw
In response to Re: Prepared Statements  (Fernando Nasser <fnasser@redhat.com>)
Responses Re: Prepared Statements
Re: Prepared Statements
Patch applied for SQL Injection vulnerability for setObject(int,Object,int)
List pgsql-jdbc
To speed things up a bit, since the regoutParam patch is not likely to
be approved anytime soon.

This patch
- adds single quotes for numbers in setObject and also setInt/Byte/etc.
- Improves getInt/Long when you may have parser errors if you're too
close to Integer.MIN_VALUE or Integer.MAX_VALUE. Thanks to Fujitsu.
- Improves radix point handling when using setObject to an integer
parameter while passing in a float. This is especially important in
callable statements.

Cheers,

Kim

On Fri, 2003-07-18 at 12:51, Fernando Nasser wrote:
> Barry Lind wrote:
> > Dmitry,
> >
> > That is a bug.  Thanks for pointing it out.  Anyone care to submit a patch?
> >
>
> Kim's patch fixes this.  It is pending approval.
>
>
>
> --
> Fernando Nasser
> Red Hat Canada Ltd.                     E-Mail:  fnasser@redhat.com
> 2323 Yonge Street, Suite #300
> Toronto, Ontario   M4P 2C9
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 1: subscribe and unsubscribe commands go to majordomo@postgresql.org


Attachment

pgsql-jdbc by date:

Previous
From: Fernando Nasser
Date:
Subject: Re: Prepared Statements
Next
From: Dmitry Tkach
Date:
Subject: Re: Prepared Statements