Received: from localhost (postgresql.org [64.49.215.8])
	by postgresql.org (Postfix) with ESMTP
	id 40ADE477504; Fri, 24 Jan 2003 14:47:35 -0500 (EST)
Received: from snoopy.oit.edu (snoopy.OIT.EDU [140.211.135.12])
	by postgresql.org (Postfix) with ESMTP
	id F329347748F; Fri, 24 Jan 2003 14:08:23 -0500 (EST)
Received: from cal-lab (purvine-141-62.oit.edu [140.211.141.62])
	by snoopy.oit.edu (8.12.6/8.12.1/OIT-1.0) with SMTP id h0OJ8Goc014192;
	Fri, 24 Jan 2003 11:08:17 -0800
From: Dennis Gearon <gearond@cvc.net>
To: "Nigel J. Andrews" <nandrews@investsystems.co.uk>,
	Greg Stark <gsstark@mit.edu>
Cc: pgsql-general@postgresql.org, pgsql-interfaces@postgresql.org
Date: Fri, 24 Jan 2003 11:13:53 -0800
X-Priority: 3 (Normal)
Reply-To: gearond@cvc.net
In-Reply-To: <87k7gupin1.fsf@stark.dyndns.tv>
Message-Id: <2ZNYVFD2X72ONE0091WQPZXGJEC7WR.3e319071@cal-lab>
Subject: Re: More PHP DB abstraction layer stuff
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Opera 6.05 build 1140
X-Virus-Scanned: by AMaViS new-20020517
X-Archive-Number: 200301/1040
X-Sequence-Number: 36161

could you elaborate on:

	Place holders ( those are in prepared queries, yes?)
	out of band?

1/24/2003 9:22:42 AM, Greg Stark <gsstark@mit.edu> wrote:

>
>"Nigel J. Andrews" <nandrews@investsystems.co.uk> writes:
>
>But the best way to deal with this is to use placeholders and prepared queries
>and provide the data out of band. This completely sidesteps the issue and
>guarantees you can't get it wrong by mistake ever. Mixing user-provided data
>with program code is a recipe for security holes.
>
>-- 
>greg
>
>
>---------------------------(end of broadcast)---------------------------
>TIP 1: subscribe and unsubscribe commands go to majordomo@postgresql.org
>