Received: from localhost (unknown [200.46.204.183])
	by developer.postgresql.org (Postfix) with ESMTP id 752882E006A
	for <pgsql-sql-postgresql.org@developer.postgresql.org>;
	Sat, 26 Apr 2008 14:05:19 -0300 (ADT)
Received: from developer.postgresql.org ([200.46.204.71])
	by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024)
	with ESMTP id 94838-03
	for <pgsql-sql-postgresql.org@developer.postgresql.org>;
	Sat, 26 Apr 2008 14:05:17 -0300 (ADT)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.5
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130])
	by developer.postgresql.org (Postfix) with ESMTP id B54012E0064
	for <pgsql-sql@postgresql.org>; Sat, 26 Apr 2008 14:05:16 -0300 (ADT)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id m3QH5E5l012891;
	Sat, 26 Apr 2008 13:05:14 -0400 (EDT)
To: "Thomas Mueller" <thomas.tom.mueller@gmail.com>
cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection 
In-reply-to: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> 
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
Comments: In-reply-to "Thomas Mueller" <thomas.tom.mueller@gmail.com>
	message dated "Sat, 26 Apr 2008 18:32:35 +0200"
Date: Sat, 26 Apr 2008 13:05:14 -0400
Message-ID: <12890.1209229514@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Archive-Number: 200804/181
X-Sequence-Number: 30720

"Thomas Mueller" <thomas.tom.mueller@gmail.com> writes:
> SET ALLOW_LITERALS NONE;

I think you missed April Fool's Day...

This is just silly, as it makes life impossibly painful for users
(constants are hardly a useless part of SQL) and it doesn't really
plug any holes.  As an example:

	select * from tab where intcol = intcol; delete from tab;

contains no literals and yet the delete is very probably injected.

			regards, tom lane