Date: Sun, 3 Apr 2005 10:33:39 -0600
From: Michael Fuhr <mike@fuhr.org>
To: Volkan YAZICI <yazicivo@ttnet.net.tr>
Cc: pgsql-interfaces@postgresql.org
Subject: Re: escaping literals (in libpq)
Message-ID: <20050403163339.GA86021@winnie.fuhr.org>
References: <20050403002747.GA1158@alamut>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050403002747.GA1158@alamut>

On Sun, Apr 03, 2005 at 03:27:47AM +0300, Volkan YAZICI wrote:
> 
> By using PQescapeString() and PQescapeBytea() we can protect SQL
> commands from SQL-Injection. I just wonder if it's necessary to
> use these escape functions when using PQexecParams() or
> PQsendQueryParams(); or these execParam functions don't need
> escaping literals?

Here's an excerpt from the PQexecParams() documentation:

    The primary advantage of PQexecParams over PQexec is that
    parameter values may be separated from the command string, thus
    avoiding the need for tedious and error-prone quoting and
    escaping.

Run some tests: create queries that do simple (but harmless) SQL
injection, submit them unescaped with PQexec() to verify that the
injection works, then escape them and submit them with PQexec() to
verify that escaping prevents the injection, then submit them
unescaped with PQexecParams() and observe what happens, then escape
them and submit them with PQexecParams() and observe what happens.

-- 
Michael Fuhr
http://www.fuhr.org/~mfuhr/