From: Dennis Gearon <gearond@cvc.net>
To: Nigel J. Andrews <nandrews@investsystems.co.uk>
To: Greg Stark <gsstark@mit.edu>
Cc: pgsql-general@postgresql.org
Cc: pgsql-interfaces@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
Date: Fri, 24 Jan 2003 11:13:53 -0800
Message-ID: <2ZNYVFD2X72ONE0091WQPZXGJEC7WR.3e319071@cal-lab> (raw)
In-Reply-To: <87k7gupin1.fsf@stark.dyndns.tv>
could you elaborate on:
Place holders ( those are in prepared queries, yes?)
out of band?
1/24/2003 9:22:42 AM, Greg Stark <gsstark@mit.edu> wrote:
>
>"Nigel J. Andrews" <nandrews@investsystems.co.uk> writes:
>
>But the best way to deal with this is to use placeholders and prepared queries
>and provide the data out of band. This completely sidesteps the issue and
>guarantees you can't get it wrong by mistake ever. Mixing user-provided data
>with program code is a recipe for security holes.
>
>--
>greg
>
>
>---------------------------(end of broadcast)---------------------------
>TIP 1: subscribe and unsubscribe commands go to majordomo@postgresql.org
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: gearond@cvc.net, nandrews@investsystems.co.uk, gsstark@mit.edu, pgsql-general@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
In-Reply-To: <2ZNYVFD2X72ONE0091WQPZXGJEC7WR.3e319071@cal-lab>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox