Received: from localhost (unknown [200.46.204.183]) by developer.postgresql.org (Postfix) with ESMTP id 1A00E2E005C for ; Sun, 27 Apr 2008 00:42:23 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 49854-10 for ; Sun, 27 Apr 2008 00:42:20 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by developer.postgresql.org (Postfix) with ESMTP id 21C612E0040 for ; Sun, 27 Apr 2008 00:42:18 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id m3R3gF98013671; Sat, 26 Apr 2008 23:42:15 -0400 (EDT) To: "Scott Marlowe" cc: "Thomas Kellerer" , pgsql-sql@postgresql.org Subject: Re: Protection from SQL injection In-reply-to: References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> Comments: In-reply-to "Scott Marlowe" message dated "Sat, 26 Apr 2008 18:21:48 -0600" Date: Sat, 26 Apr 2008 23:42:14 -0400 Message-ID: <13670.1209267734@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200804/188 X-Sequence-Number: 30727 "Scott Marlowe" writes: > Wouldn't it be much simpler to have a version of the libpq client lib > that only understands prepared queries? You could do that, but there's still no way for it to know exactly how the submitted query was constructed. This would block off the types of injections that want to add whole SQL commands, but not ones that just subvert the current query (eg adding OR TRUE to see data you shouldn't). This is really a client problem and only client-side solutions will provide meaningful traction for it. In perl, for instance, the "taint" mechanism is a good way to notice whether any insecure strings are getting into database queries. regards, tom lane