pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Ivan Sergio Borgonovo <mail@webthatworks.it>
To: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 11:29:09 +0200
Message-ID: <20080427112909.053cab47@dawn.webthatworks.it> (raw)
In-Reply-To: <dcc563d10804262224l431f0ae3t6c75af94a1ef3876@mail.gmail.com>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<13885.1209268720@sss.pgh.pa.us>
	<dcc563d10804262224l431f0ae3t6c75af94a1ef3876@mail.gmail.com>

On Sat, 26 Apr 2008 23:24:59 -0600
"Scott Marlowe" <scott.marlowe@gmail.com> wrote:

> On Sat, Apr 26, 2008 at 9:58 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> 
> >  IIRC there was some discussion recently of providing a mode in
> > which the server would reject PQexec strings containing more than
> > one query. I didn't care for it much at the time, but I think it
> > would provide most of the benefit of these suggestions with far
> > less compatibility or performance hit.
> 
> agreed.

> And I trust (SQL) code review more than tying the hands of the
> programmers.

> But I've always had the luxury of working with developers who liked
> me as a DBA and were willing to do things my way, as far as the DB
> was concerned anyway...

what if you're the DBA and the dev and you don't trust yourself even
if you'd be willing to do the things your way ;)

-- 
Ivan Sergio Borgonovo
http://www.webthatworks.it




view thread (23+ messages)  latest in thread

Message-ID: <20080427112909.053cab47@dawn.webthatworks.it>
Permalink:  ../20080427112909.053cab47@dawn.webthatworks.it/
Also on:    postgresql.org/message-id/20080427112909.053cab47@dawn.webthatworks.it

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: mail@webthatworks.it
  Subject: Re: Protection from SQL injection
  In-Reply-To: <20080427112909.053cab47@dawn.webthatworks.it>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox