Postgres Pro
Downloads
Home   >   mailing lists

Re: Avoiding SQL injection in Dynamic Queries (in plpgsql) - Mailing list pgsql-general

From Craig Ringer
Subject Re: Avoiding SQL injection in Dynamic Queries (in plpgsql)
Date
Msg-id 4BA095AB.9050902@postnewspapers.com.au
Whole thread Raw
In response to Avoiding SQL injection in Dynamic Queries (in plpgsql)  (Allan Kamau <kamauallan@gmail.com>)
Responses Re: Avoiding SQL injection in Dynamic Queries (in plpgsql)  (Allan Kamau <kamauallan@gmail.com>)
List pgsql-general
Tree view 
Allan Kamau wrote:
> When writing dynamic commands (those having "EXECUTE 'some SQL
> query';), is there a way to prevent interpretation of input parameters
> as pieces of SQL commands?

EXECUTE ... USING

--
Craig Ringer

pgsql-general by date:

Previous
From: Allan Kamau
Date:
Subject: Avoiding SQL injection in Dynamic Queries (in plpgsql)
Next
From: Allan Kamau
Date:
Subject: Re: Avoiding SQL injection in Dynamic Queries (in plpgsql)