Re: Protection from SQL injection - Mailing list pgsql-hackers

From PFC
Subject Re: Protection from SQL injection
Date
Msg-id op.uae694f6cigqcu@apollo13.peufeu.com
Whole thread Raw
In response to Re: Protection from SQL injection  (Hannu Krosing <hannu@krosing.net>)
List pgsql-hackers
> Could we also get a mode, where PREPARE would only be allowed for
> queries of the form "SELECT * FROM func(?,?,?,?,?); :)
Actually, that is similar to the concept of "global prepared statements"  
that I proposed some time ago, but I will not have time to write the  
patch, alas...Idea was that the DBA can create a list of SQL statements (with  
privileges about who can execute them, just like functions) which are  
prepared on-demand at the first EXECUTE by the client.This would enhance performance (but for performance I like the
ideaof  
 
caching plans better).It would be pretty cumbersome, though, to execute dynamic SQL like the  
typical search query...


pgsql-hackers by date:

Previous
From: Tino Wildenhain
Date:
Subject: Re: Protection from SQL injection
Next
From: "Thomas Mueller"
Date:
Subject: Re: Protection from SQL injection