Received: from localhost (unknown [200.46.204.184]) by developer.postgresql.org (Postfix) with ESMTP id 07D862E0033 for ; Sat, 26 Apr 2008 21:21:54 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 67880-03 for ; Sat, 26 Apr 2008 21:21:42 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.180]) by developer.postgresql.org (Postfix) with ESMTP id DAB102E002D for ; Sat, 26 Apr 2008 21:21:49 -0300 (ADT) Received: by wa-out-1112.google.com with SMTP id n7so6947305wag.5 for ; Sat, 26 Apr 2008 17:21:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=QrRsJNGhbqTxJnfqfpuq4lEe9Uqcvmy/Sysd+478bqQ=; b=eplZFcF7O6aKVkF50V5luZh8TzTR/qn5NfU+uf50bNUt9VqKgZYDFREdg21j34xhddsL7/vP8Qfw++bNzPAft1deY+cSZ18u8e5SGBpqz/vwBnSu+hcZaXM1UWlwS70X5TeEziniB1BB6FIitrD5wKBTLS+Z4vS4fuWVrfPv2a8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=O1kAO20N1z5DTKeBSPhN1dYM6sMXlQu2J8Nd2Bf4fI4TtSyfPxGPHw3m3loES3z1vqHycWGIE43BL8P3hocZHjJKQXHUmpppi2EA33wYazkbJtxKqvgrZe0dTqTPLB3PQcmmoA6R9477J7UXTz2RiFxXmH0DbOovDNcCkhN0hPM= Received: by 10.114.159.17 with SMTP id h17mr4880430wae.227.1209255708463; Sat, 26 Apr 2008 17:21:48 -0700 (PDT) Received: by 10.114.137.7 with HTTP; Sat, 26 Apr 2008 17:21:48 -0700 (PDT) Message-ID: Date: Sat, 26 Apr 2008 18:21:48 -0600 From: "Scott Marlowe" To: "Thomas Kellerer" Subject: Re: Protection from SQL injection Cc: pgsql-sql@postgresql.org In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200804/187 X-Sequence-Number: 30726 On Sat, Apr 26, 2008 at 3:32 PM, Thomas Kellerer wrote: > Thomas Mueller wrote on 26.04.2008 18:32: > > > Literals can still be used when using query tools, or in applications > considered 'safe'. > > > I fail to see how the backend could distinguish between a query sent by a > query tool and a query sent by an "application". Wouldn't it be much simpler to have a version of the libpq client lib that only understands prepared queries?