From: Scott Marlowe <scott.marlowe@gmail.com>
To: Thomas Kellerer <spam_eater@gmx.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sat, 26 Apr 2008 18:21:48 -0600
Message-ID: <dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com> (raw)
In-Reply-To: <fv0727$cge$1@ger.gmane.org>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
<fv0727$cge$1@ger.gmane.org>
On Sat, Apr 26, 2008 at 3:32 PM, Thomas Kellerer <spam_eater@gmx.net> wrote:
> Thomas Mueller wrote on 26.04.2008 18:32:
>
> > Literals can still be used when using query tools, or in applications
> considered 'safe'.
> >
> I fail to see how the backend could distinguish between a query sent by a
> query tool and a query sent by an "application".
Wouldn't it be much simpler to have a version of the libpq client lib
that only understands prepared queries?
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: scott.marlowe@gmail.com, spam_eater@gmx.net
Subject: Re: Protection from SQL injection
In-Reply-To: <dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox