Thank for your reply.
"Lincoln Yeoh" <lyeoh@pop.jaring.my> wrote in message
news:3.0.5.32.20010409121916.00851100@192.228.128.13...
> When I checked some time back some PHP + MySQL scripts allowed multiple SQL
> statements per query - just stick a semicolon in somewhere, and you can do
> ANY arbitrary SQL you want.
>
> for example:
>
> select * from mytable where field='$cgiparam'
>
> Someone just has to make sure $cgiparam is
> 1';drop table blah; select '1
>
> And then you're screwed. Of course you aren't supposed to write apps that
> way, but anyone want to tell the masses out there?
Even with current pg_Exec (PQExec), the same thing can be done.
So any inputs from users must be checked anyway.
As most web programmers do not trust any user inputs, I check user inputs both
form class level (Using HTML form fields definition) and db class level (Using
metadata from system tables), so it should be fine. (There are many other
security protections at network/host/application/user levels also)
However, I see a some PHP scripts that do not handle user inputs properly. It's
worth to mention :)
I believe most PostgreSQL/PHP users do this, but anyway
Don't forget to use addslashes() for user inputs before feeding them to
PostgreSQL at least.
Regards,
--
Yasuo Ohgaki
