Received: from smaug.polygnosis.com ([195.139.160.221]) by postgresql.org (8.11.3/8.11.1) with ESMTP id f65ADsa67529 for ; Thu, 5 Jul 2001 06:13:54 -0400 (EDT) (envelope-from gunnar@smaug.polygnosis.com) Received: (from gunnar@localhost) by smaug.polygnosis.com (8.11.0/8.11.0) id f65AD5i15701; Thu, 5 Jul 2001 12:13:05 +0200 To: "George Koras" Cc: "Barry Lind" , "Arsalan Zaidi" , "PostgreSQL jdbc list" Subject: Re: Re: [INTERFACES] New code for JDBC driver References: <200106301642.f5UGgkj14915@candle.pha.pa.us> <3B3E7A94.209@xythos.com> <00b801c102c4$fdd49ea0$4301a8c0@directi.com> <3B409F8F.7050408@xythos.com> <00b501c10386$00ab1e80$4301a8c0@directi.com> <3B41E22B.5000901@xythos.com> <005101c1052d$0a519330$1a49e98f@cres.gr> From: Gunnar =?iso-8859-1?q?R=F8nning?= Date: 05 Jul 2001 12:13:05 +0200 In-Reply-To: <005101c1052d$0a519330$1a49e98f@cres.gr> Message-ID: Lines: 24 User-Agent: Gnus/5.0808 (Gnus v5.8.8) Emacs/20.7 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Archive-Number: 200107/30 X-Sequence-Number: 950 * "George Koras" wrote: | So I guess a solution would be to escape *quotes* and not *semicolons out of | quotes*, which is the solution I use in my programs and on which comments | are invited . This also prevents the malicious use Arsanal is talking about, | doesn't it? | | However the PreparedStatement solution (which I haven't tried) seems to be | more elegant. | PreparedStatement is the right solution for this. If you don't trust your input SQL either use that or do custom escaping on before sending the SQL to the driver. I wouldn't like to add another performance bottleneck, especially when it is not mandated by the spec. The JDBC driver for Sybase works the same way. regards, Gunnar -- Gunnar Rønning - gunnar@polygnosis.com Senior Consultant, Polygnosis AS, http://www.polygnosis.com/