pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Joe <dev@freedomcircle.net>
To: Ivan Sergio Borgonovo <mail@webthatworks.it>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 11:55:18 -0400
Message-ID: <4814A1E6.1070200@freedomcircle.net> (raw)
In-Reply-To: <20080427142253.449de600@dawn.webthatworks.it>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<20080427123848.5c841788@dawn.webthatworks.it>
	<20080427142253.449de600@dawn.webthatworks.it>

Ivan Sergio Borgonovo wrote:
> It'd be nice to have a wrapper that let you write prepared statements
> this way:
>
> "select a.id, b.name from a join b on a.id=b.id where
> a.status=$variable1 and b.id>$variable2 etc... but that's a pretty
> good change to any language parser.
>   

Python already supports something like that. See PEP 249 
(http://www.python.org/dev/peps/pep-0249/), under Module Interface, the 
description of the paramstyle parameter. Psycopg2 supports both the 
"format" (C printf) and "pyformat" styles. See the last section on this 
page for an example using the pyformat style: 
http://www.devx.com/opensource/Article/29071/0/page/3.

Joe



view thread (23+ messages)  latest in thread

Message-ID: <4814A1E6.1070200@freedomcircle.net>
Permalink:  ../4814A1E6.1070200@freedomcircle.net/
Also on:    postgresql.org/message-id/4814A1E6.1070200@freedomcircle.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: dev@freedomcircle.net, mail@webthatworks.it
  Subject: Re: Protection from SQL injection
  In-Reply-To: <4814A1E6.1070200@freedomcircle.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox