From: Jaime Casanova <systemguards@gmail.com>
To: Thomas Mueller <thomas.tom.mueller@gmail.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sat, 26 Apr 2008 16:31:46 -0500
Message-ID: <c2d9e70e0804261431y6f25f783hf5d43121749b7aba@mail.gmail.com> (raw)
In-Reply-To: <5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
<c2d9e70e0804261116yca965eflf24586c4ca0cf852@mail.gmail.com>
<5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com>
On Sat, Apr 26, 2008 at 1:19 PM, Thomas Mueller
<thomas.tom.mueller@gmail.com> wrote:
> Hi,
>
> > > The 'ALLOW_LITERALS NONE' mode is enabled by the developer itself, or
> > > by an administrator.
> > then it solves nothing...
> > what if the developer never SET ALLOW_LITERALS NONE
>
> As I have said, the 'ALLOW_LITERALS NONE' mode is enabled by the
> developer itself, or by an administrator. The developer may be lazy,
> but the administrator can enforce this policy.
>
but can't the developer allow literals again?
> > maybe i can inject "select * from tab where intcol = intcol; set
> > allow_literals all; add any query you want"
>
> How do you inject this? How would the application looks like where
> this can be injected?
>
ok... point taken
--
regards,
Jaime Casanova
Soporte de PostgreSQL
Guayaquil - Ecuador
Cel. (593) 087171157
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: systemguards@gmail.com, thomas.tom.mueller@gmail.com
Subject: Re: Protection from SQL injection
In-Reply-To: <c2d9e70e0804261431y6f25f783hf5d43121749b7aba@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox