Received: from cresdb.cres.gr (cresdb.cres.gr [143.233.73.4]) by postgresql.org (8.11.3/8.11.1) with ESMTP id f65ALOa70700 for ; Thu, 5 Jul 2001 06:21:24 -0400 (EDT) (envelope-from gkoras@cres.gr) Received: from gkoras ([143.233.73.26]) by cresdb.cres.gr (8.9.3/8.9.3) with ESMTP id WAA21543; Thu, 5 Jul 2001 22:32:01 +0200 (EET) Message-ID: <010d01c1053c$24f5cdf0$1a49e98f@cres.gr> From: "George Koras" To: =?iso-8859-7?Q?Gunnar_R=F8nning?= Cc: "Barry Lind" , "Arsalan Zaidi" , "PostgreSQL jdbc list" References: <200106301642.f5UGgkj14915@candle.pha.pa.us><3B3E7A94.209@xythos.com> <00b801c102c4$fdd49ea0$4301a8c0@directi.com><3B409F8F.7050408@xythos.com><00b501c10386$00ab1e80$4301a8c0@directi.com><3B41E22B.5000901@xythos.com> <005101c1052d$0a519330$1a49e98f@cres.gr> Subject: Re: Re: [INTERFACES] New code for JDBC driver Date: Thu, 5 Jul 2001 13:20:40 +0300 Organization: Center for Renewable Energy Sources MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-7" Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 X-Archive-Number: 200107/31 X-Sequence-Number: 951 Yes, I agree that it certainly has to be done before SQL is sent to the driver, i.e. in the middle tier! Is it a performance bottleneck? Would PreparedStatement be more efficient? ----- Original Message ----- From: Gunnar Rønning To: George Koras Cc: Barry Lind ; Arsalan Zaidi ; PostgreSQL jdbc list Sent: Thursday, July 05, 2001 1:13 PM Subject: Re: [JDBC] Re: [INTERFACES] New code for JDBC driver > * "George Koras" wrote: > > | So I guess a solution would be to escape *quotes* and not *semicolons out of > | quotes*, which is the solution I use in my programs and on which comments > | are invited . This also prevents the malicious use Arsanal is talking about, > | doesn't it? > | > | However the PreparedStatement solution (which I haven't tried) seems to be > | more elegant. > | > > PreparedStatement is the right solution for this. If you don't trust > your input SQL either use that or do custom escaping on before sending > the SQL to the driver. > > I wouldn't like to add another performance bottleneck, especially when it is > not mandated by the spec. The JDBC driver for Sybase works the same way. > > regards, > > Gunnar > -- > Gunnar Rønning - gunnar@polygnosis.com > Senior Consultant, Polygnosis AS, http://www.polygnosis.com/ >