From: George Koras <gkoras@cres.gr>
To: Barry Lind <barry@xythos.com>
To: Arsalan Zaidi <azaidi@directi.com>
Cc: PostgreSQL jdbc list <pgsql-jdbc@postgresql.org>
Subject: Re: [INTERFACES] New code for JDBC driver
Date: Thu, 5 Jul 2001 11:32:00 +0300
Message-ID: <005101c1052d$0a519330$1a49e98f@cres.gr> (raw)
References: <200106301642.f5UGgkj14915@candle.pha.pa.us>
<3B3E7A94.209@xythos.com>
<00b801c102c4$fdd49ea0$4301a8c0@directi.com>
<3B409F8F.7050408@xythos.com>
<00b501c10386$00ab1e80$4301a8c0@directi.com>
<3B41E22B.5000901@xythos.com>
Similar problems can arise even if the end user has no bad intentions. In
the example Arsanal mentioned, what if Sinead O'Connor is a user? Wouldn't
this result in the following query?
update users set name='Sinead O'Connor
which gives the error:
ERROR: parser: parse error at or near "connor"
So I guess a solution would be to escape *quotes* and not *semicolons out of
quotes*, which is the solution I use in my programs and on which comments
are invited . This also prevents the malicious use Arsanal is talking about,
doesn't it?
However the PreparedStatement solution (which I haven't tried) seems to be
more elegant.
This thing seems pretty elementary. Isn't it covered in a FAQ somewhere?
----- Original Message -----
From: Barry Lind <barry@xythos.com>
To: Arsalan Zaidi <azaidi@directi.com>
Cc: PostgreSQL jdbc list <pgsql-jdbc@postgresql.org>
Sent: Tuesday, July 03, 2001 6:18 PM
Subject: Re: [INTERFACES] New code for JDBC driver
>
> Now to your situation. The obvious solution is to use prepared
> statements in your middle tier having the client provide the values from
> the text fields to be bound into the query.
>
> > "update users set name='"+name+"'"
>
> So the client sends you the 'name' value and the middle tier uses a
> preparedstatement to bind that value to the update.
>
> Arsalan Zaidi wrote:
>
> > I agree that it probably is. Unfortunately, as I mentioned in my
previous
> > post,no one is going to be entering in SQL queries directly through our
> > interface. We're not doing it and if someone is, he's up to no good.
e.g.
> >
> > "update users set name='"+name+"'"
> >
> > If there's a text box in which you enter your name for the first query,
I
> > can some fun if I enter in
> >
> > Arsalan';update funds set money = 100000 where userid =10
> >
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: gkoras@cres.gr, barry@xythos.com, azaidi@directi.com, pgsql-jdbc@postgresql.org
Subject: Re: [INTERFACES] New code for JDBC driver
In-Reply-To: <005101c1052d$0a519330$1a49e98f@cres.gr>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox