Received: from localhost (unknown [200.46.204.184]) by developer.postgresql.org (Postfix) with ESMTP id CB0A82E005C for ; Sun, 27 Apr 2008 00:58:52 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 11964-05 for ; Sun, 27 Apr 2008 00:58:46 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by developer.postgresql.org (Postfix) with ESMTP id B3B572E0032 for ; Sun, 27 Apr 2008 00:58:44 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id m3R3wfoZ013886; Sat, 26 Apr 2008 23:58:41 -0400 (EDT) To: "Scott Marlowe" cc: "Thomas Kellerer" , pgsql-sql@postgresql.org Subject: Re: Protection from SQL injection In-reply-to: References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> <13670.1209267734@sss.pgh.pa.us> Comments: In-reply-to "Scott Marlowe" message dated "Sat, 26 Apr 2008 21:50:10 -0600" Date: Sat, 26 Apr 2008 23:58:40 -0400 Message-ID: <13885.1209268720@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200804/190 X-Sequence-Number: 30729 "Scott Marlowe" writes: > Agreed. My point was that to do what the OP wants, wouldn't it make > more sense to just lobotomize libpq so it doesn't understand anything > but prepared queries. I doubt that that particular lobotomization accomplishes much in comparison to the penalties. IIRC there was some discussion recently of providing a mode in which the server would reject PQexec strings containing more than one query. I didn't care for it much at the time, but I think it would provide most of the benefit of these suggestions with far less compatibility or performance hit. regards, tom lane