From: David Hinkle <drachs@gmail.com>
To: pgsql-interfaces@postgresql.org
Subject: Re: libpq, PQExecParams and the inserting of binary data
Date: Fri, 3 Jun 2005 12:36:38 -0500
Message-ID: <ae830e6c05060310367c37a84a@mail.gmail.com> (raw)
In-Reply-To: <7104a7370506030943662e4be@mail.gmail.com>
References: <ae830e6c05060309182201f85b@mail.gmail.com>
<7104a7370506030943662e4be@mail.gmail.com>
Yea, I know, but that doesn't help me. I need to know how to insert
binary data. I can't do it as text without escaping because it's not
null terminated and may contain nulls. I can't do it as binary
because I don't have any documentation on how to use it that way.
What I'm asking for is an expample or a document showing me how to do
it. I already know my way doesn't work.
If you could show me the proper way to do it that would be great.
David
On 6/3/05, Volkan YAZICI <volkan.yazici@gmail.com> wrote:
> Hi,
>
> On 6/3/05, David Hinkle <drachs@gmail.com> wrote:
> > As you can see, I assumed I could use PQexapeBytea to escape the
> > binary data and then just use the returned value as a text parameter.
>
> You don't need to (also you shouldn't) escape any data while using
> parameters. Because, you'll miss one big advantage of parameter usage.
> From PQexecParams() documentation:
>
> «The primary advantage of PQexecParams over PQexec is that parameter
> values may be separated from the command string, thus avoiding the
> need for tedious and error-prone quoting and escaping. Unlike PQexec,
> PQexecParams allows at most one SQL command in the given string.
> (There can be semicolons in it, but not more than one nonempty
> command.) This is a limitation of the underlying protocol, but has
> some usefulness as an extra defense against SQL-injection attacks.»
>
> Regards.
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: drachs@gmail.com
Subject: Re: libpq, PQExecParams and the inserting of binary data
In-Reply-To: <ae830e6c05060310367c37a84a@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox