pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Thomas Mueller <thomas.tom.mueller@gmail.com>
To: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 09:08:30 +0200
Message-ID: <5f211bd50804270008l326acd69ia4b845e651992cfc@mail.gmail.com> (raw)
In-Reply-To: <c2d9e70e0804261431y6f25f783hf5d43121749b7aba@mail.gmail.com>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<c2d9e70e0804261116yca965eflf24586c4ca0cf852@mail.gmail.com>
	<5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com>
	<c2d9e70e0804261431y6f25f783hf5d43121749b7aba@mail.gmail.com>

Hi,

>  but can't the developer allow literals again?

Executing the statement SET ALLOW_LITERALS should be restricted. The
application uses another user name / password and doesn't have to
access rights to enable it. Maybe the user name / password is
configured using JNDI, so the application developper has no influence
on that. In any case, even if the developer can enable literals, I
don't think he would, because he would be afraid to be caught
cheating.

Regards,
Thomas



view thread (23+ messages)  latest in thread

Message-ID: <5f211bd50804270008l326acd69ia4b845e651992cfc@mail.gmail.com>
Permalink:  ../5f211bd50804270008l326acd69ia4b845e651992cfc@mail.gmail.com/
Also on:    postgresql.org/message-id/5f211bd50804270008l326acd69ia4b845e651992cfc@mail.gmail.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: thomas.tom.mueller@gmail.com
  Subject: Re: Protection from SQL injection
  In-Reply-To: <5f211bd50804270008l326acd69ia4b845e651992cfc@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox