X-Original-To: pgsql-interfaces-postgresql.org@localhost.postgresql.org Received: from localhost (unknown [200.46.204.144]) by svr1.postgresql.org (Postfix) with ESMTP id 3877C5333B for ; Sun, 3 Apr 2005 13:28:33 +0100 (BST) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 44914-02 for ; Sun, 3 Apr 2005 12:28:24 +0000 (GMT) Received: from fep03.ttnet.net.tr (fep03fe.ttnet.net.tr [212.156.4.134]) by svr1.postgresql.org (Postfix) with ESMTP id 3DF1F52808 for ; Sun, 3 Apr 2005 13:28:21 +0100 (BST) Received: from esafe4.ttnet.net.tr ([172.25.0.14]) by fep03.ttnet.net.tr with SMTP id <20050403122813.WCEJ2550.fep03.ttnet.net.tr@esafe4.ttnet.net.tr> for ; Sun, 3 Apr 2005 15:28:13 +0300 Received: from fep05.ttnet.net.tr ([IP=212.156.4.136]) by eSafe SMTP Relay 1112521977; Sun Apr 3 15:29:13 2005 Received: from alamut ([212.156.162.170]) by fep05.ttnet.net.tr with ESMTP id <20050403122822.HRKO2440.fep05.ttnet.net.tr@alamut> for ; Sun, 3 Apr 2005 15:28:22 +0300 Date: Sun, 3 Apr 2005 03:27:47 +0300 From: Volkan YAZICI To: pgsql-interfaces@postgresql.org Subject: escaping literals (in libpq) Message-ID: <20050403002747.GA1158@alamut> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.2.1i X-ESAFE-STATUS: Mail clean X-ESAFE-DETAILS: Clean X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, hits=1.756 tagged_above=0 required=5 tests=AWL, DNS_FROM_RFC_ABUSE, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: * X-Archive-Number: 200504/12 X-Sequence-Number: 5428 Hi, By using PQescapeString() and PQescapeBytea() we can protect SQL commands from SQL-Injection. I just wonder if it's necessary to use these escape functions when using PQexecParams() or PQsendQueryParams(); or these execParam functions don't need escaping literals? # End of file