From: Richard Huxton <dev@archonet.com>
To: "Denis" <sqllist@coralindia.com>, <pgsql-sql@postgresql.org>
Subject: Re: how to preserve \n in select statement
Date: Mon, 22 Dec 2003 10:48:20 +0000
User-Agent: KMail/1.5
References: <BAY9-F42t0CI76rOJhK00098f93@hotmail.com>
	<200312220904.11730.dev@archonet.com>
	<004c01c3c86f$389c5380$0f32a8c0@denisnew>
In-Reply-To: <004c01c3c86f$389c5380$0f32a8c0@denisnew>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200312221048.20783.dev@archonet.com>

On Monday 22 December 2003 09:37, Denis wrote:
> Hi Richard..
>
> If your users are required to fire only SELECT and no DML, you can do the
> following:
>
> BEGIN;
> execute the statements given by user
> ROLLBACK;
>
> This will not affect your SELECT and also if any malicious user gives
> DELETE statement, that will not have any impact too..

An interesting idea, though you'd need to be careful with side-effects 
(triggers/functions etc). I seem to recall a "read-only" setting being 
discussed for transactions too (though not as a security measure, I should 
emphasise).

The other thing is to use the database user/group mechanism - something which 
tends to be neglected with web-based apps (partly because different DBs have 
different setups here).
If only an application super-user can add/delete users make sure the 
permissions reflect this and connect as a more restricted user for other 
logins.

-- 
  Richard Huxton
  Archonet Ltd