"David E. Wheeler" <david@kineticode.com> writes:
> On Sep 9, 2009, at 10:04 AM, Tom Lane wrote:
>> Well, yeah: it looks like a fertile source of security holes, not to
>> mention implementation difficulties (plpgsql really wants well-typed
>> expressions...). What you can do at the C level is not necessarily
>> sane to give to PL authors. I'm willing to consider a carefully
>> spec'd out proposal in this area, but "open the floodgates" ain't it.
> Security holes? Huh? What security holes would there be that you don't
> already have with anyelement?
Well, none, *if* it's defined to have exactly the same runtime behavior
as anyelement does. It sounded like you were arguing for something
looser. We could certainly define it as being just like anyelement
but not constrained to match any other argument or result (and, hence,
not usable as a result type).
regards, tom lane
