Re: Protection from SQL injection - Mailing list pgsql-hackers

From Andrew Sullivan
Subject Re: Protection from SQL injection
Date
Msg-id 20080502204712.GL21477@commandprompt.com
Whole thread Raw
In response to Re: Protection from SQL injection  (Chris Browne <cbbrowne@acm.org>)
Responses Re: Protection from SQL injection  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-hackers
On Fri, May 02, 2008 at 03:58:01PM -0400, Chris Browne wrote:

> Andrew Sullivan recently had some choice words about the merits of
> ENUM; I think the same applies to drivers that do
> PQexec("COMMIT;BEGIN")...

Oh, heaven.  I can at least think of ways to use ENUM such that you
can justify the trade-off.  I can think of no excuse whatever for
PQexec("COMMIT; BEGIN").  That's just lazy and sloppy.  

Note also that more recent releases, concurrent with the improvements
to the drivers, also reduce the impact of this sort of database misuse
slightly.

But really, people who are doing that sort of thing have no excuse for
themselves.  They should be relegated to the same circle of hell as
people who think it's a good plan to write a crappy schema the first
time, because you can always optimise later.

A  

-- 
Andrew Sullivan
ajs@commandprompt.com
+1 503 667 4564 x104
http://www.commandprompt.com/


pgsql-hackers by date:

Previous
From: "Hell, Robert"
Date:
Subject: Re: [PATCHES] GUC parameter cursors_tuple_fraction
Next
From: Simon Riggs
Date:
Subject: Re: [PATCHES] GUC parameter cursors_tuple_fraction