Re: Protection from SQL injection - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Protection from SQL injection
Date
Msg-id 25702.1209764606@sss.pgh.pa.us
Whole thread Raw
In response to Re: Protection from SQL injection  (Andrew Sullivan <ajs@commandprompt.com>)
List pgsql-hackers
Andrew Sullivan <ajs@commandprompt.com> writes:
> Oh, heaven.  I can at least think of ways to use ENUM such that you
> can justify the trade-off.  I can think of no excuse whatever for
> PQexec("COMMIT; BEGIN").  That's just lazy and sloppy.  

> Note also that more recent releases, concurrent with the improvements
> to the drivers, also reduce the impact of this sort of database misuse
> slightly.

Actually, as of 8.3 I think the impact is zero, because of the lazy
XID allocation changes.  It's still sloppy programming though.
        regards, tom lane


pgsql-hackers by date:

Previous
From: Jan Urbański
Date:
Subject: VacAttrStatsP vs VacAttrStats * (typedef'ing pointer types)
Next
From: Neil Conway
Date:
Subject: Re: VacAttrStatsP vs VacAttrStats * (typedef'ing pointer types)