From: Gunnar Rønning <gunnar@polygnosis.com>
To: George Koras <gkoras@cres.gr>
Cc: Barry Lind <barry@xythos.com>
Cc: Arsalan Zaidi <azaidi@directi.com>
Cc: PostgreSQL jdbc list <pgsql-jdbc@postgresql.org>
Subject: Re: Re: [INTERFACES] New code for JDBC driver
Date: 05 Jul 2001 12:13:05 +0200
Message-ID: <m2elrvu1ji.fsf@smaug.polygnosis.com> (raw)
In-Reply-To: <005101c1052d$0a519330$1a49e98f@cres.gr>
References: <200106301642.f5UGgkj14915@candle.pha.pa.us>
<3B3E7A94.209@xythos.com>
<00b801c102c4$fdd49ea0$4301a8c0@directi.com>
<3B409F8F.7050408@xythos.com>
<00b501c10386$00ab1e80$4301a8c0@directi.com>
<3B41E22B.5000901@xythos.com>
<005101c1052d$0a519330$1a49e98f@cres.gr>
* "George Koras" <gkoras@cres.gr> wrote:
| So I guess a solution would be to escape *quotes* and not *semicolons out of
| quotes*, which is the solution I use in my programs and on which comments
| are invited . This also prevents the malicious use Arsanal is talking about,
| doesn't it?
|
| However the PreparedStatement solution (which I haven't tried) seems to be
| more elegant.
|
PreparedStatement is the right solution for this. If you don't trust
your input SQL either use that or do custom escaping on before sending
the SQL to the driver.
I wouldn't like to add another performance bottleneck, especially when it is
not mandated by the spec. The JDBC driver for Sybase works the same way.
regards,
Gunnar
--
Gunnar Rønning - gunnar@polygnosis.com
Senior Consultant, Polygnosis AS, http://www.polygnosis.com/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: gunnar@polygnosis.com, gkoras@cres.gr, barry@xythos.com, azaidi@directi.com, pgsql-jdbc@postgresql.org
Subject: Re: Re: [INTERFACES] New code for JDBC driver
In-Reply-To: <m2elrvu1ji.fsf@smaug.polygnosis.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox