Re: Protection from SQL injection - Mailing list pgsql-hackers

On Wed, Apr 30, 2008 at 10:20:09AM -0400, Andrew Sullivan wrote:
> On Tue, Apr 29, 2008 at 09:02:30PM -0400, Gregory Stark wrote:
> > Did you guys miss Tom's comment up-thread? Postgres already does this if you
> > use PQExecParams().
>
> I did, yes.  Thanks for the clue.  OTOH, I do see the OP's point that
> it'd be nice if the DBA could enforce this rule.  Maybe a way of
> insisting on PQExecParams() instead of anything else?

Create a function somewhere:

void PQexec()
{ die();
}

And it will override the one in the shared library. In other languages
subclassing should be able to provide the same effect.

Have a nice day,
--
Martijn van Oosterhout   <kleptog@svana.org>   http://svana.org/kleptog/
> Please line up in a tree and maintain the heap invariant while
> boarding. Thank you for flying nlogn airlines.