Received: from localhost (unknown [200.46.204.184]) by developer.postgresql.org (Postfix) with ESMTP id 570872E003E for ; Sat, 26 Apr 2008 15:19:47 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 29384-03 for ; Sat, 26 Apr 2008 15:19:39 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.171]) by developer.postgresql.org (Postfix) with ESMTP id DED262E0031 for ; Sat, 26 Apr 2008 15:19:41 -0300 (ADT) Received: by wf-out-1314.google.com with SMTP id 28so3223961wff.28 for ; Sat, 26 Apr 2008 11:19:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=jHMXcNe8/aW7xkAJSCEyOePSHh3ex8aVjxCrM+6T+Ls=; b=Q1Lvh5knYiTM8FWvdEd1KSKeK7AkQK+gPgY+nSX1w5Dovy/gMU/KlFnZZdjZ4dTPnwDeTiwsv6nZzhy4lNWPJFkjgzsCoJCoywvA9bPJHtQAW8hrNtbuyXeO4SgpKO3iwBSDbklvPxwrOfdoAyulpiUjhO5kourd0pHIKzIK/SQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=hNEv7C8xXBfqUGH0LbQVHm1Jspp+rAqLAIyHxB2nP2YzHcE4NfsuxNWl4KfI9LPekqZKMvYIAYM8NwJNciXAVFFcg8W7HVkdkLZDs/SJ3sXk3F8LlyeAfp5uUAMwZcjqOpAjtQUqu5hP1qRgPDFJo+U6GDwUZRwHPY6BiBVKGK8= Received: by 10.142.77.11 with SMTP id z11mr1564322wfa.23.1209233980966; Sat, 26 Apr 2008 11:19:40 -0700 (PDT) Received: by 10.142.127.4 with HTTP; Sat, 26 Apr 2008 11:19:40 -0700 (PDT) Message-ID: <5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com> Date: Sat, 26 Apr 2008 20:19:40 +0200 From: "Thomas Mueller" To: pgsql-sql@postgresql.org Subject: Re: Protection from SQL injection In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200804/184 X-Sequence-Number: 30723 Hi, > > The 'ALLOW_LITERALS NONE' mode is enabled by the developer itself, or > > by an administrator. > then it solves nothing... > what if the developer never SET ALLOW_LITERALS NONE As I have said, the 'ALLOW_LITERALS NONE' mode is enabled by the developer itself, or by an administrator. The developer may be lazy, but the administrator can enforce this policy. > maybe i can inject "select * from tab where intcol = intcol; set > allow_literals all; add any query you want" How do you inject this? How would the application looks like where this can be injected? Regards, Thomas