Re: Is passing a list as a bound variable safe from SQL injection? - Mailing list psycopg

From Stuart Bishop
Subject Re: Is passing a list as a bound variable safe from SQL injection?
Date
Msg-id CADmi=6NsbvmaELJF0JFswnqPeVJuY_X1GSQ9SqQt4GS=Et5rhg@mail.gmail.com
Whole thread Raw
In response to Re: Is passing a list as a bound variable safe from SQL injection?  (Federico Di Gregorio <fog@dndg.it>)
List psycopg
On Thu, Oct 3, 2013 at 2:53 PM, Federico Di Gregorio <fog@dndg.it> wrote:

> Btw, I am a little curious, what kind of query requires an array of
> ~11000 values? Surely there is a better way to write it, isn't it?

I see it a lot when breaking up bulk operations into small chunks. If
you can't use a temporary table persisting across transactions (eg.
pgbouncer in transaction pooling mode), the fastest way is often a
script that first sucks down a huge list of ids and does the update in
lots of small transactions. It works because PG happily handles
queries like 'UPDATE foo SET bar='baz' WHERE id IN ([... 10,000 ids
...])' without breaking a sweat, even though on the surface it looks
like a really silly thing to do.

--
Stuart Bishop <stuart@stuartbishop.net>
http://www.stuartbishop.net/


psycopg by date:

Previous
From: Daniele Varrazzo
Date:
Subject: Re: Is passing a list as a bound variable safe from SQL injection?
Next
From: Peter Eisentraut
Date:
Subject: Re: psycopg2 doesn't use LDFLAGS from pg_config