pg.ddx.io  pgsql-interfaces@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Volkan YAZICI <yazicivo@ttnet.net.tr>
To: pgsql-interfaces@postgresql.org
Subject: escaping literals (in libpq)
Date: Sun, 3 Apr 2005 03:27:47 +0300
Message-ID: <20050403002747.GA1158@alamut> (raw)

Hi,

By using PQescapeString() and PQescapeBytea() we can protect SQL
commands from SQL-Injection. I just wonder if it's necessary to
use these escape functions when using PQexecParams() or
PQsendQueryParams(); or these execParam functions don't need
escaping literals?

# End of file

view thread (3+ messages)  latest in thread

Message-ID: <20050403002747.GA1158@alamut>
Permalink:  ../20050403002747.GA1158@alamut/
Also on:    postgresql.org/message-id/20050403002747.GA1158@alamut

copy link · copy postgr.es

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-interfaces@postgresql.org
  Cc: yazicivo@ttnet.net.tr
  Subject: Re: escaping literals (in libpq)
  In-Reply-To: <20050403002747.GA1158@alamut>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox