From: Dmitry Tkach <dmitry@openratings.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Denis Zaitsev <zzz@anda.ru>
Cc: pgsql-sql@postgresql.org
Subject: Re: Very strange 'now' behaviour in nested triggers.
Date: Mon, 28 Jul 2003 13:18:58 -0400
Message-ID: <3F255B02.80607@openratings.com> (raw)
In-Reply-To: <15800.1059412373@sss.pgh.pa.us>
References: <20030726193947.B1636@natasha.ward.six>
<9412.1059229904@sss.pgh.pa.us>
<20030727020104.A19865@natasha.ward.six>
<4629.1059320950@sss.pgh.pa.us>
<3F2552BF.5060100@openratings.com>
<15184.1059411161@sss.pgh.pa.us>
<3F255813.1000401@openratings.com>
<15800.1059412373@sss.pgh.pa.us>
Tom Lane wrote:
>Dmitry Tkach <dmitry@openratings.com> writes:
>
>
>>Does it mean that the *application* (not the database) user would then
>>have to know the exact specific way to represent the current time in his
>>data entry form?
>>Such an application looks like (how do I say it politely?) not a very
>>user-friendly one to me :-)
>>
>>
>
>So? "now()" is certainly not more user-friendly than "now".
>
Nope... it isn't.
My point was that, if the app wanted to be user friendly, it would not
attempt to take the input directly from user and stuff it into the sql -
it would probably have some checkbox or drop-down list in the GUI form,
that would indicate that the user wants the current time stamp, and use
the the proper internal represntation in the generated sql...
In that case having to execute a function (now()) would not make it
vulnerable to a sql injection...
> My point
>is that wherever you are making the decision that you want to input
>current time, there may be layers between you and the database that will
>only want to pass data-value strings and not function invocations.
>
>
>
Yeah... I've actually found one after I sent that last message :-) - it
does seem to come handy in COPY TABLE - although, in that case, I'd say
it would be much more useful to make COPY TABLE understand the defined
defaults on the table, just the way INSERT does ...
Dima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: dmitry@openratings.com, tgl@sss.pgh.pa.us, zzz@anda.ru
Subject: Re: Very strange 'now' behaviour in nested triggers.
In-Reply-To: <3F255B02.80607@openratings.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox