pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Ivan Sergio Borgonovo <mail@webthatworks.it>
To: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 19:18:40 +0200
Message-ID: <20080427191840.494b6bf7@dawn.webthatworks.it> (raw)
In-Reply-To: <4814A1E6.1070200@freedomcircle.net>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<20080427123848.5c841788@dawn.webthatworks.it>
	<20080427142253.449de600@dawn.webthatworks.it>
	<4814A1E6.1070200@freedomcircle.net>

On Sun, 27 Apr 2008 11:55:18 -0400
Joe <dev@freedomcircle.net> wrote:

> Ivan Sergio Borgonovo wrote:
> > It'd be nice to have a wrapper that let you write prepared
> > statements this way:
> >
> > "select a.id, b.name from a join b on a.id=b.id where
> > a.status=$variable1 and b.id>$variable2 etc... but that's a pretty
> > good change to any language parser.

> Python already supports something like that. See PEP 249 
> (http://www.python.org/dev/peps/pep-0249/), under Module Interface,
> the description of the paramstyle parameter. Psycopg2 supports both
> the "format" (C printf) and "pyformat" styles. See the last section
> on this page for an example using the pyformat style: 
> http://www.devx.com/opensource/Article/29071/0/page/3.

That's better than nothing but it is still a lot of code duplication.
You've to write column names in the sql statement and in the array
and... column values are not contextual to the statement.
That's easy... while what I wrote above does look as requiring a
really special parser.

Furthermore from the example it looks as if all this is going to
miss the scope to prevent sql injection since it doesn't support
prepared statements.


-- 
Ivan Sergio Borgonovo
http://www.webthatworks.it




view thread (23+ messages)  latest in thread

Message-ID: <20080427191840.494b6bf7@dawn.webthatworks.it>
Permalink:  ../20080427191840.494b6bf7@dawn.webthatworks.it/
Also on:    postgresql.org/message-id/20080427191840.494b6bf7@dawn.webthatworks.it

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: mail@webthatworks.it
  Subject: Re: Protection from SQL injection
  In-Reply-To: <20080427191840.494b6bf7@dawn.webthatworks.it>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox