From: Ivan Sergio Borgonovo <mail@webthatworks.it>
To: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 14:22:53 +0200
Message-ID: <20080427142253.449de600@dawn.webthatworks.it> (raw)
In-Reply-To: <20080427123848.5c841788@dawn.webthatworks.it>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
<fv0727$cge$1@ger.gmane.org>
<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
<13670.1209267734@sss.pgh.pa.us>
<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
<20080427123848.5c841788@dawn.webthatworks.it>
On Sun, 27 Apr 2008 12:38:48 +0200
Ivan Sergio Borgonovo <mail@webthatworks.it> wrote:
> Once you've developers that are so patient to write stuff like:
>
> "select a.id, b.name from a join b on b.id=a.id where
> a.status='pending' and b.id>7 and b.status='logged'"
>
> into
>
> "select a.id, b.name from a join b on b.id=a.id where
> a.status=? and b.id>? and b.status=?", 'pending', 7, 'logged'
>
> there are high chances they will prefer to spend some of their time
> actually thinking about what they are writing.
[snipped here and there]
> Prepared statements force you to match input with position and it is
> definitively error prone.
It'd be nice to have a wrapper that let you write prepared statements
this way:
"select a.id, b.name from a join b on a.id=b.id where
a.status=$variable1 and b.id>$variable2 etc... but that's a pretty
good change to any language parser.
Maybe it could be obtained by use of macro...
That will turn
new_query("select a.id, b.name from a join b on a.id=b.id where
a.status=$variable1 and b.id>$variable2");
into
pg_prepare('anonymous', 'select a.id, b.name from a join b on
a.id=b.id where a.status=$1 and b.id>$2');
pg_execute('anonymous',array($variable1,$variable2));
but aren't macro evil
Still it would be handy.
--
Ivan Sergio Borgonovo
http://www.webthatworks.it
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: mail@webthatworks.it
Subject: Re: Protection from SQL injection
In-Reply-To: <20080427142253.449de600@dawn.webthatworks.it>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox