From: Tom Lane <tgl@sss.pgh.pa.us>
To: Glen K <glenk1973@hotmail.com>
cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: Re: Feature request: Settings to disable comments and multiple statements in a connection
In-reply-to: <BN0P223MB0152E29A351757553BB74C19A86CA@BN0P223MB0152.NAMP223.PROD.OUTLOOK.COM>
References: <BN0P223MB0152E29A351757553BB74C19A86CA@BN0P223MB0152.NAMP223.PROD.OUTLOOK.COM>
Comments: In-reply-to Glen K <glenk1973@hotmail.com>
	message dated "Wed, 04 Jun 2025 22:41:15 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1079731.1749078352.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 04 Jun 2025 19:05:52 -0400
Message-ID: <1079732.1749078352@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1079732.1749078352%40sss.pgh.pa.us>
Precedence: bulk

Glen K <glenk1973@hotmail.com> writes:
> My feature requests are thus:

> Provide a client connection option (and/or implement the backend support=
) to disallow comments in SQL statements

I don't believe that this would move the needle on SQL-injection
safety by enough to be worth doing.  An injection attack is normally
trying to break out of a quoted string, not a comment.

> Provide a client connection option (and/or implement the backend support=
) to allow only one statement in an execute request

This exists already; you just have to use the extended query protocol.

> Provide an option in the client execute functions (and/or implement
> the backend support) to specify the expected number of statements.

I don't see the need for this given #2.

			regards, tom lane