From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thomas Mueller <thomas.tom.mueller@gmail.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sat, 26 Apr 2008 13:05:14 -0400
Message-ID: <12890.1209229514@sss.pgh.pa.us> (raw)
In-Reply-To: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
"Thomas Mueller" <thomas.tom.mueller@gmail.com> writes:
> SET ALLOW_LITERALS NONE;
I think you missed April Fool's Day...
This is just silly, as it makes life impossibly painful for users
(constants are hardly a useless part of SQL) and it doesn't really
plug any holes. As an example:
select * from tab where intcol = intcol; delete from tab;
contains no literals and yet the delete is very probably injected.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, thomas.tom.mueller@gmail.com
Subject: Re: Protection from SQL injection
In-Reply-To: <12890.1209229514@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox