Re: Protection from SQL injection - Mailing list pgsql-hackers

From Alvaro Herrera
Subject Re: Protection from SQL injection
Date
Msg-id 20080502145358.GC2320@alvh.no-ip.org
Whole thread Raw
In response to Re: Protection from SQL injection  (Darren Reed <darrenr+postgres@fastmail.net>)
Responses Re: Protection from SQL injection  ("Greg Sabino Mullane" <greg@turnstep.com>)
List pgsql-hackers
Darren Reed wrote:

> Because interacting with the database is always through an action
> that you do and if you're being half way intelligent about it, you
> are always checking that each action succeeded before going on to
> the next.

Hmm, it won't be pretty for the drivers that do PQexec("COMMIT; BEGIN").
The driver will think that it's in a transaction when in fact the second
command in the string has been ignored, and so it's not ...

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.


pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: Protection from SQL injection
Next
From: Michael Meskes
Date:
Subject: Re: ecpg issue - not sending datatype to the backend