Received: from localhost (unknown [200.46.204.183]) by developer.postgresql.org (Postfix) with ESMTP id 3866C2E003E for ; Sat, 26 Apr 2008 18:31:51 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 31977-01 for ; Sat, 26 Apr 2008 18:31:47 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.177]) by developer.postgresql.org (Postfix) with ESMTP id 750522E0032 for ; Sat, 26 Apr 2008 18:31:47 -0300 (ADT) Received: by wa-out-1112.google.com with SMTP id n7so6878384wag.5 for ; Sat, 26 Apr 2008 14:31:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=CSKNWKIKz2lLXMZm+5dOp9PoF7z+10yHCIGs/LNqQeM=; b=IjQkf7XHU+WQOP8MfSBFyh3DmlIEc8YplYs0oQh0Wzq1wTJXOjdrubMEVnAmx58JtMeFjAcUjw/kr6cq/D6ntslnRGoTj6cNKEcYkevXepisf+whYE6rdlc/oS+ZEOd4abXC2ZbXMN84RLzb4I3rea7wZT9as2n8qXEh14EAUuw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=iJqC5ZFoJvVa6wls6Zx/1DVg+EZ9k028utEMxCYt4ZODbxvaU5zY/id6pYxOiu7ta4uwjwDO6i3dt5cPiIa6iswXrxGR7tLDFVMyLAWzs1rl+izQU5HbzD921/mBtjK5HnTV7hitP0rPI4tXCYvnAzzLZGMIAHIi/CPtTjNBFe4= Received: by 10.115.73.20 with SMTP id a20mr4750360wal.213.1209245506392; Sat, 26 Apr 2008 14:31:46 -0700 (PDT) Received: by 10.114.67.1 with HTTP; Sat, 26 Apr 2008 14:31:46 -0700 (PDT) Message-ID: Date: Sat, 26 Apr 2008 16:31:46 -0500 From: "Jaime Casanova" To: "Thomas Mueller" Subject: Re: Protection from SQL injection Cc: pgsql-sql@postgresql.org In-Reply-To: <5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> <5f211bd50804261119x25c6d488hec0cde5bab189ac5@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200804/185 X-Sequence-Number: 30724 On Sat, Apr 26, 2008 at 1:19 PM, Thomas Mueller wrote: > Hi, > > > > The 'ALLOW_LITERALS NONE' mode is enabled by the developer itself, or > > > by an administrator. > > then it solves nothing... > > what if the developer never SET ALLOW_LITERALS NONE > > As I have said, the 'ALLOW_LITERALS NONE' mode is enabled by the > developer itself, or by an administrator. The developer may be lazy, > but the administrator can enforce this policy. > but can't the developer allow literals again? > > maybe i can inject "select * from tab where intcol = intcol; set > > allow_literals all; add any query you want" > > How do you inject this? How would the application looks like where > this can be injected? > ok... point taken -- regards, Jaime Casanova Soporte de PostgreSQL Guayaquil - Ecuador Cel. (593) 087171157