Received: from localhost (unknown [200.46.204.184]) by developer.postgresql.org (Postfix) with ESMTP id 2CF7F2E002E for ; Sun, 27 Apr 2008 04:08:35 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 64320-03 for ; Sun, 27 Apr 2008 04:08:28 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.175]) by developer.postgresql.org (Postfix) with ESMTP id 5C5DE2E002D for ; Sun, 27 Apr 2008 04:08:31 -0300 (ADT) Received: by wf-out-1314.google.com with SMTP id 28so3393067wff.28 for ; Sun, 27 Apr 2008 00:08:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=8YkXITE5SvBpFAQtYhPBq8UqW9IlkXf624Qn2h5qxI8=; b=l9dfT2q0OzRPbJiskOx0x5SRPJwafWVjFVel88zhVvvQ2mrEIuEEoTMW28W104U+3GFipvMCAC9GNV144/cSZWY7u426EEjFiyJDXDYos2RlAuJ2xsK+PAftQ/B0OMjYgdTqP/hWoXoAb0nkUZoLd1abdmxjMiwZIdSItui2Sac= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=jtpbFqyG9/gRDkoj9xYD8sD03L8nMalBnzl/yvZ88Ifw3a/KLiWfDRx8bM+febqj/j29Ie1C7jsbNXS0n0r8eMsJV3h88iMMd/Q093l1WlNvOpbXuNeEKJKYww+4e1gbCQnQzXB2j2cOfR/c9cQNTFe6z6KcXyOW+uuIrQh8pG4= Received: by 10.142.57.17 with SMTP id f17mr1726725wfa.340.1209280110403; Sun, 27 Apr 2008 00:08:30 -0700 (PDT) Received: by 10.142.127.4 with HTTP; Sun, 27 Apr 2008 00:08:30 -0700 (PDT) Message-ID: <5f211bd50804270008l326acd69ia4b845e651992cfc@mail.gmail.com> Date: Sun, 27 Apr 2008 09:08:30 +0200 From: "Thomas Mueller" To: pgsql-sql@postgresql.org Subject: Re: Protection from SQL injection In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> <5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200804/192 X-Sequence-Number: 30731 Hi, > but can't the developer allow literals again? Executing the statement SET ALLOW_LITERALS should be restricted. The application uses another user name / password and doesn't have to access rights to enable it. Maybe the user name / password is configured using JNDI, so the application developper has no influence on that. In any case, even if the developer can enable literals, I don't think he would, because he would be afraid to be caught cheating. Regards, Thomas