pg.ddx.io pgsql-interfaces@postgresql.org mailing list archive
help / color / mirror / Atom feedescaping literals (in libpq)
3+ messages / 3 participants
[nested] [flat]
* escaping literals (in libpq)
@ 2005-04-03 00:27 Volkan YAZICI <yazicivo@ttnet.net.tr>
2005-04-03 16:33 ` Re: escaping literals (in libpq) Michael Fuhr <mike@fuhr.org>
0 siblings, 1 reply; 3+ messages in thread
From: Volkan YAZICI @ 2005-04-03 00:27 UTC (permalink / raw)
To: pgsql-interfaces
Hi,
By using PQescapeString() and PQescapeBytea() we can protect SQL
commands from SQL-Injection. I just wonder if it's necessary to
use these escape functions when using PQexecParams() or
PQsendQueryParams(); or these execParam functions don't need
escaping literals?
# End of file
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: escaping literals (in libpq)
2005-04-03 00:27 escaping literals (in libpq) Volkan YAZICI <yazicivo@ttnet.net.tr>
@ 2005-04-03 16:33 ` Michael Fuhr <mike@fuhr.org>
2005-04-03 17:11 ` Re: escaping literals (in libpq) Volkan YAZICI <volkan.yazici@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Michael Fuhr @ 2005-04-03 16:33 UTC (permalink / raw)
To: Volkan YAZICI <yazicivo@ttnet.net.tr>; +Cc: pgsql-interfaces
On Sun, Apr 03, 2005 at 03:27:47AM +0300, Volkan YAZICI wrote:
>
> By using PQescapeString() and PQescapeBytea() we can protect SQL
> commands from SQL-Injection. I just wonder if it's necessary to
> use these escape functions when using PQexecParams() or
> PQsendQueryParams(); or these execParam functions don't need
> escaping literals?
Here's an excerpt from the PQexecParams() documentation:
The primary advantage of PQexecParams over PQexec is that
parameter values may be separated from the command string, thus
avoiding the need for tedious and error-prone quoting and
escaping.
Run some tests: create queries that do simple (but harmless) SQL
injection, submit them unescaped with PQexec() to verify that the
injection works, then escape them and submit them with PQexec() to
verify that escaping prevents the injection, then submit them
unescaped with PQexecParams() and observe what happens, then escape
them and submit them with PQexecParams() and observe what happens.
--
Michael Fuhr
http://www.fuhr.org/~mfuhr/
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: escaping literals (in libpq)
2005-04-03 00:27 escaping literals (in libpq) Volkan YAZICI <yazicivo@ttnet.net.tr>
2005-04-03 16:33 ` Re: escaping literals (in libpq) Michael Fuhr <mike@fuhr.org>
@ 2005-04-03 17:11 ` Volkan YAZICI <volkan.yazici@gmail.com>
0 siblings, 0 replies; 3+ messages in thread
From: Volkan YAZICI @ 2005-04-03 17:11 UTC (permalink / raw)
To: pgsql-interfaces
Hi,
On Apr 3, 2005 7:33 PM, Michael Fuhr <mike@fuhr.org> wrote:
> Here's an excerpt from the PQexecParams() documentation:
>
> The primary advantage of PQexecParams over PQexec is that
> parameter values may be separated from the command string, thus
> avoiding the need for tedious and error-prone quoting and
> escaping.
>
> Run some tests: create queries that do simple (but harmless) SQL
> injection, submit them unescaped with PQexec() to verify that the
> injection works, then escape them and submit them with PQexec() to
> verify that escaping prevents the injection, then submit them
> unescaped with PQexecParams() and observe what happens, then escape
> them and submit them with PQexecParams() and observe what happens.
Thanks so much. I engrossed a little bit in my work and forgot the
main point in documentation.
Here's a little piece of code i scratched:
* template1=# SELECT * FROM mytbl;
* usernm | passwd | secret
* --------+----------+-----------------
* volkan | password | Home address...
* (1 row)
*/
#include <stdio.h>
#include <libpq-fe.h>
#define BUFLEN 1024
int main(void)
{
PGconn *conn;
PGresult *res;
const char user[] = "volkan";
const char passwd[] = "fakepasswd' OR '' = '";
const char *values[2];
char command[BUFLEN];
conn = PQconnectdb("user=postgres dbname=template1");
snprintf(command, BUFLEN, "SELECT secret FROM mytbl WHERE "
"user = '%s' AND passwd = '%s'", user, passwd);
res = PQexec(conn, command);
printf("%d\n", PQntuples(res));
PQclear(res);
values[0] = user;
values[1] = passwd;
res = PQexecParams(conn, "SELECT secret FROM mytbl WHERE "
"user = '$1' AND passwd = '$2'",
2, NULL, values, NULL, NULL, 0);
printf("%d\n", PQntuples(res));
PQclear(res);
return 0;
}
/*
* $ gcc -Wall -lpq execParams.c &&./a.out
* 1
* 0
*/
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2005-04-03 17:11 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2005-04-03 00:27 escaping literals (in libpq) Volkan YAZICI <yazicivo@ttnet.net.tr>
2005-04-03 16:33 ` Michael Fuhr <mike@fuhr.org>
2005-04-03 17:11 ` Volkan YAZICI <volkan.yazici@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox