Re: Protection from SQL injection - Mailing list pgsql-hackers

From Kris Jurka
Subject Re: Protection from SQL injection
Date
Msg-id Pine.BSO.4.64.0804301005070.10085@leary.csoft.net
Whole thread Raw
In response to Re: Protection from SQL injection  (Josh Berkus <josh@agliodbs.com>)
List pgsql-hackers

On Tue, 29 Apr 2008, Josh Berkus wrote:

>> Did you guys miss Tom's comment up-thread? Postgres already does this if
>> you use PQExecParams().
>
> Keen.  Now we just need to get the driver developers to implement it.  I
> imagine Java does.
>

The JDBC driver takes a multi-command statement and splits it up to be 
able to use the extended query protocol.  So the JDBC driver is actually
doing the reverse of your suggestion.  For us it was a decision to ease 
the transition from V2 to V3 protocol and not break code that used to 
work.

Kris Jurka


pgsql-hackers by date:

Previous
From: "Guillaume Smet"
Date:
Subject: Re: Column storage positions
Next
From: Alvaro Herrera
Date:
Subject: Re: Proposed patch - psql wraps at window width