Re: design, plpgsql and sql injection in dynamically generated sql - Mailing list pgsql-general

From Sam Mason
Subject Re: design, plpgsql and sql injection in dynamically generated sql
Date
Msg-id 20090817154214.GH5407@samason.me.uk
Whole thread Raw
In response to design, plpgsql and sql injection in dynamically generated sql  (Ivan Sergio Borgonovo <mail@webthatworks.it>)
List pgsql-general
On Mon, Aug 17, 2009 at 12:36:49PM +0200, Ivan Sergio Borgonovo wrote:
> I've several list of items that have to be rendered on a web apps in
> the same way.
[..]
> the nature of the lists and their usage pattern is very different.
> So unless someone come up with a better design I still would like to
> keep the item lists in different tables.

As you've explained it, I'd be tempted to have a function for each
table.  You're going to have special code outside the database for each
one, so why not a (small) amount for each one inside the database.

> I'd like to build up a function that takes the name of the table and
> the key to dynamically build up the query... but I don't know what
> should I use to sanitize them.

I'd stay away from this; they may be doing similar things at the moment
but if they really are as different as you seem to suggest then having
them as separate functions would make this easier.

If they really are that similar then you should have all the data in one
table anyway!

--
  Sam  http://samason.me.uk/

pgsql-general by date:

Previous
From: Bryan Murphy
Date:
Subject: ERROR: attempted to delete invisible tuple
Next
From: Chris Barnes
Date:
Subject: Pgbench tool download