Re: Protection from SQL injection - Mailing list pgsql-hackers

From Gregory Stark
Subject Re: Protection from SQL injection
Date
Msg-id 87zlrcf93t.fsf@oxford.xeocode.com
Whole thread Raw
In response to Re: Protection from SQL injection  (Josh Berkus <josh@agliodbs.com>)
Responses Re: Protection from SQL injection  (Josh Berkus <josh@agliodbs.com>)
Re: Protection from SQL injection  (Andrew Sullivan <ajs@commandprompt.com>)
List pgsql-hackers
"Josh Berkus" <josh@agliodbs.com> writes:

>> (I sort of like the
>> suggestion up-thread, myself, which is to have a GUC that disables
>> multi-statement commands.  That'd probably cover a huge number of
>> cases, and combined with some sensible quoting rules in client
>> libraries, would quite possibly be enough.)
>
> MySQL did this already.

Did you guys miss Tom's comment up-thread? Postgres already does this if you
use PQExecParams().

--  Gregory Stark EnterpriseDB          http://www.enterprisedb.com Ask me about EnterpriseDB's Slony Replication
support!


pgsql-hackers by date:

Previous
From: "Gurjeet Singh"
Date:
Subject: Re: Protection from SQL injection
Next
From: Josh Berkus
Date:
Subject: Re: Protection from SQL injection