From: Volkan YAZICI <volkan.yazici@gmail.com>
To: David Hinkle <drachs@gmail.com>
Cc: pgsql-interfaces@postgresql.org
Subject: Re: libpq, PQExecParams and the inserting of binary data
Date: Fri, 3 Jun 2005 19:43:34 +0300
Message-ID: <7104a7370506030943662e4be@mail.gmail.com> (raw)
In-Reply-To: <ae830e6c05060309182201f85b@mail.gmail.com>
References: <ae830e6c05060309182201f85b@mail.gmail.com>
Hi,
On 6/3/05, David Hinkle <drachs@gmail.com> wrote:
> As you can see, I assumed I could use PQexapeBytea to escape the
> binary data and then just use the returned value as a text parameter.
You don't need to (also you shouldn't) escape any data while using
parameters. Because, you'll miss one big advantage of parameter usage.
From PQexecParams() documentation:
«The primary advantage of PQexecParams over PQexec is that parameter
values may be separated from the command string, thus avoiding the
need for tedious and error-prone quoting and escaping. Unlike PQexec,
PQexecParams allows at most one SQL command in the given string.
(There can be semicolons in it, but not more than one nonempty
command.) This is a limitation of the underlying protocol, but has
some usefulness as an extra defense against SQL-injection attacks.»
Regards.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: volkan.yazici@gmail.com, drachs@gmail.com
Subject: Re: libpq, PQExecParams and the inserting of binary data
In-Reply-To: <7104a7370506030943662e4be@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox