Received: from localhost (unknown [200.46.204.183]) by developer.postgresql.org (Postfix) with ESMTP id 3342D2E0035 for ; Sun, 27 Apr 2008 06:14:15 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 20027-03 for ; Sun, 27 Apr 2008 06:14:12 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.174]) by developer.postgresql.org (Postfix) with ESMTP id C1FAA2E0040 for ; Sun, 27 Apr 2008 06:14:12 -0300 (ADT) Received: by wf-out-1314.google.com with SMTP id 28so3420032wff.28 for ; Sun, 27 Apr 2008 02:14:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=7IcrVnfjeadrU4B0nOaO1nMHo0dr3jbc4KC/Q0j+7us=; b=f3iEsSfr4jycqBQ9PL8Pw/5pjbpiU5TagCJUCS81ywz5wK4pZgij8SpbxdMqvGDcdLJSkSV6SA5wYXnt7JH0rr0QlC2DNnYyx11T/L0ypKE2+7KMCh2dt8FcgrR8XZV8aB1If4vyVZUviw25JXsnT0edR7a+PeugUr0bfeQli/Q= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=uEWXmBAkzqDc37D7DPTgmLcyF9mYOa2Hm6XN15hIZ3IV4lsV7XFWLXKMh9j5QtXWdKnhgPlERcLH8Y5AOya/mSTRz8ovv72esOixdrqZwBlAuvrhvL6VqPAFNAL1i0V/PdHRglc8U53yYIJGRdy4Hs1XJxxGNf4BnL1pdfURkn0= Received: by 10.142.134.17 with SMTP id h17mr1767906wfd.346.1209287651724; Sun, 27 Apr 2008 02:14:11 -0700 (PDT) Received: by 10.142.127.4 with HTTP; Sun, 27 Apr 2008 02:14:11 -0700 (PDT) Message-ID: <5f211bd50804270214s852989me86c61caecadb5b@mail.gmail.com> Date: Sun, 27 Apr 2008 11:14:11 +0200 From: "Thomas Mueller" To: pgsql-sql@postgresql.org Subject: Re: Protection from SQL injection In-Reply-To: <13885.1209268720@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> <13670.1209267734@sss.pgh.pa.us> <13885.1209268720@sss.pgh.pa.us> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200804/195 X-Sequence-Number: 30734 Hi, > providing a mode in which the server would reject PQexec strings containing more than one query. That wouldn't help a lot. The simple SQL injection is not detected: ResultSet rs = stat.executeQuery( "SELECT * FROM USERS WHERE PASSWORD='" + password + "'"); An attacker would only need to use the following password: ' OR 1=1 The the SQL statements is still only one query: SELECT * FROM USERS WHERE PASSWORD='' OR 1=1 Regards, Thomas