Re: question - Mailing list pgsql-sql

From Vivek Khera
Subject Re: question
Date
Msg-id 9158F005-5B73-405A-8CD6-97D6B4621F62@khera.org
Whole thread Raw
In response to question  ("Matt A." <survivedsushi@yahoo.com>)
List pgsql-sql
On Aug 24, 2005, at 1:05 AM, Matt A. wrote:

> We used nullif('$value','') on inserts in mssql.  We
> moved to postgres and love it but the nullif() doesn't
> match empty strings to each other to return null other
> than a text type, causing an error. This is a major
> part of our application.

I *certainly* hope you're not passing $value in straight from your  
web form directly into the SQL.  You're opening yourself up for SQL  
injection attacks.

Why not just have your app that reads the form generate the proper  
value to insert? That is the safe route.

Vivek Khera, Ph.D.
+1-301-869-4449 x806




pgsql-sql by date:

Previous
From: Halley Pacheco de Oliveira
Date:
Subject: Re: question
Next
From: "Thomas F. O'Connell"
Date:
Subject: Re: Numerical variables in pqsql statements