X-Original-To: pgsql-sql@postgresql.org Received: from localhost (postgresql.org [64.49.215.8]) by postgresql.org (Postfix) with ESMTP id 6478A477534 for ; Fri, 31 Jan 2003 23:45:49 -0500 (EST) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by postgresql.org (Postfix) with ESMTP id 7FBD247617A for ; Fri, 31 Jan 2003 23:43:25 -0500 (EST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.6/8.12.6) with ESMTP id h114hM5u004329; Fri, 31 Jan 2003 23:43:22 -0500 (EST) To: Matthew Horoschun Cc: pgsql-sql@postgresql.org Subject: Re: Controlling access to Sequences In-reply-to: <8BB55A7D-359D-11D7-92E5-000393B3A702@canprint.com.au> References: <8BB55A7D-359D-11D7-92E5-000393B3A702@canprint.com.au> Comments: In-reply-to Matthew Horoschun message dated "Sat, 01 Feb 2003 15:28:00 +1100" Date: Fri, 31 Jan 2003 23:43:22 -0500 Message-ID: <4328.1044074602@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by AMaViS new-20020517 X-Archive-Number: 200301/533 X-Sequence-Number: 11398 Matthew Horoschun writes: > Should I just avoid SEQUENCES altogether and use the OIDs under normal > circumstances and the MAX( id ) + 1 style thing when I need a > human-usable number? I don't think so. MAX()+1 has more than enough problems of its own. The real bottom line here is that you should not allow untrustworthy users any sort of direct access to SQL commands of any kind. They should only be allowed access to an application that issues suitably restricted SQL commands on their behalf. regards, tom lane