pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Joe <dev@freedomcircle.net>
To: Ivan Sergio Borgonovo <mail@webthatworks.it>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 14:25:06 -0400
Message-ID: <4814C502.7070604@freedomcircle.net> (raw)
In-Reply-To: <20080427191840.494b6bf7@dawn.webthatworks.it>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<20080427123848.5c841788@dawn.webthatworks.it>
	<20080427142253.449de600@dawn.webthatworks.it>
	<4814A1E6.1070200@freedomcircle.net>
	<20080427191840.494b6bf7@dawn.webthatworks.it>

Ivan Sergio Borgonovo wrote:
> That's better than nothing but it is still a lot of code duplication.
> You've to write column names in the sql statement and in the array
> and... column values are not contextual to the statement.
>   

The apparent duplication in the example stems for its tutorial nature. 
In a real program, the namedict "array" (it's actually a Python 
tuple--an immutable array) would normally be constructed 
programmatically from user or other input. Note also that although 
Joshua chose to use dictionary keys named identical to the PG column 
names, they could be named differently, like "first" and "last".
> That's easy... while what I wrote above does look as requiring a
> really special parser.
>
> Furthermore from the example it looks as if all this is going to
> miss the scope to prevent sql injection since it doesn't support
> prepared statements.
>   

I assume you didn't check the PEP 249 
(http://www.python.org/dev/peps/pep-0249/). The execute() and 
executemany() Cursor object methods are precisely to prepare and execute 
database operations.

Joe



view thread (23+ messages)  latest in thread

Message-ID: <4814C502.7070604@freedomcircle.net>
Permalink:  ../4814C502.7070604@freedomcircle.net/
Also on:    postgresql.org/message-id/4814C502.7070604@freedomcircle.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: dev@freedomcircle.net, mail@webthatworks.it
  Subject: Re: Protection from SQL injection
  In-Reply-To: <4814C502.7070604@freedomcircle.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox