Received: from localhost (unknown [200.46.204.184]) by developer.postgresql.org (Postfix) with ESMTP id BE4DB2E0069 for ; Sun, 27 Apr 2008 06:29:17 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 96011-05 for ; Sun, 27 Apr 2008 06:29:09 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from smtp-out26.alice.it (smtp-out26.alice.it [85.33.2.26]) by developer.postgresql.org (Postfix) with ESMTP id D59C82E0035 for ; Sun, 27 Apr 2008 06:29:13 -0300 (ADT) Received: from FBCMMO01.fbc.local ([192.168.68.195]) by smtp-out26.alice.it with Microsoft SMTPSVC(6.0.3790.1830); Sun, 27 Apr 2008 11:29:11 +0200 Received: from FBCMCL01B05.fbc.local ([192.168.69.86]) by FBCMMO01.fbc.local with Microsoft SMTPSVC(6.0.3790.1830); Sun, 27 Apr 2008 11:29:11 +0200 Received: from kerberos.webthatworks.it ([80.117.26.143]) by FBCMCL01B05.fbc.local with Microsoft SMTPSVC(6.0.3790.1830); Sun, 27 Apr 2008 11:29:11 +0200 Received: from dawn.webthatworks.it (dawn.webthatworks.it [192.168.1.12]) by kerberos.webthatworks.it (Postfix) with ESMTP id 38177E6A96 for ; Sun, 27 Apr 2008 11:29:10 +0200 (CEST) Received: from dawn.webthatworks.it (localhost [127.0.0.1]) by dawn.webthatworks.it (Postfix) with ESMTP id ED19E39B26 for ; Sun, 27 Apr 2008 11:29:09 +0200 (CEST) Date: Sun, 27 Apr 2008 11:29:09 +0200 From: Ivan Sergio Borgonovo To: pgsql-sql@postgresql.org Subject: Re: Protection from SQL injection Message-ID: <20080427112909.053cab47@dawn.webthatworks.it> In-Reply-To: References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> <13670.1209267734@sss.pgh.pa.us> <13885.1209268720@sss.pgh.pa.us> Organization: http://www.webthatworks.it X-Mailer: Claws Mail 3.4.0 (GTK+ 2.12.9; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 27 Apr 2008 09:29:11.0639 (UTC) FILETIME=[26C20E70:01C8A849] X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200804/196 X-Sequence-Number: 30735 On Sat, 26 Apr 2008 23:24:59 -0600 "Scott Marlowe" wrote: > On Sat, Apr 26, 2008 at 9:58 PM, Tom Lane wrote: > > > IIRC there was some discussion recently of providing a mode in > > which the server would reject PQexec strings containing more than > > one query. I didn't care for it much at the time, but I think it > > would provide most of the benefit of these suggestions with far > > less compatibility or performance hit. > > agreed. > And I trust (SQL) code review more than tying the hands of the > programmers. > But I've always had the luxury of working with developers who liked > me as a DBA and were willing to do things my way, as far as the DB > was concerned anyway... what if you're the DBA and the dev and you don't trust yourself even if you'd be willing to do the things your way ;) -- Ivan Sergio Borgonovo http://www.webthatworks.it