From: Michael Fuhr <mike@fuhr.org>
To: Volkan YAZICI <yazicivo@ttnet.net.tr>
Cc: pgsql-interfaces@postgresql.org
Subject: Re: escaping literals (in libpq)
Date: Sun, 3 Apr 2005 10:33:39 -0600
Message-ID: <20050403163339.GA86021@winnie.fuhr.org> (raw)
In-Reply-To: <20050403002747.GA1158@alamut>
References: <20050403002747.GA1158@alamut>
On Sun, Apr 03, 2005 at 03:27:47AM +0300, Volkan YAZICI wrote:
>
> By using PQescapeString() and PQescapeBytea() we can protect SQL
> commands from SQL-Injection. I just wonder if it's necessary to
> use these escape functions when using PQexecParams() or
> PQsendQueryParams(); or these execParam functions don't need
> escaping literals?
Here's an excerpt from the PQexecParams() documentation:
The primary advantage of PQexecParams over PQexec is that
parameter values may be separated from the command string, thus
avoiding the need for tedious and error-prone quoting and
escaping.
Run some tests: create queries that do simple (but harmless) SQL
injection, submit them unescaped with PQexec() to verify that the
injection works, then escape them and submit them with PQexec() to
verify that escaping prevents the injection, then submit them
unescaped with PQexecParams() and observe what happens, then escape
them and submit them with PQexecParams() and observe what happens.
--
Michael Fuhr
http://www.fuhr.org/~mfuhr/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: mike@fuhr.org, yazicivo@ttnet.net.tr
Subject: Re: escaping literals (in libpq)
In-Reply-To: <20050403163339.GA86021@winnie.fuhr.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox