From: Scott Marlowe <scott.marlowe@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Thomas Kellerer <spam_eater@gmx.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sat, 26 Apr 2008 23:24:59 -0600
Message-ID: <dcc563d10804262224l431f0ae3t6c75af94a1ef3876@mail.gmail.com> (raw)
In-Reply-To: <13885.1209268720@sss.pgh.pa.us>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
<fv0727$cge$1@ger.gmane.org>
<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
<13670.1209267734@sss.pgh.pa.us>
<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
<13885.1209268720@sss.pgh.pa.us>
On Sat, Apr 26, 2008 at 9:58 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> IIRC there was some discussion recently of providing a mode in which
> the server would reject PQexec strings containing more than one query.
> I didn't care for it much at the time, but I think it would provide
> most of the benefit of these suggestions with far less compatibility
> or performance hit.
agreed.
And I trust (SQL) code review more than tying the hands of the programmers.
But I've always had the luxury of working with developers who liked me
as a DBA and were willing to do things my way, as far as the DB was
concerned anyway...
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: scott.marlowe@gmail.com, tgl@sss.pgh.pa.us, spam_eater@gmx.net
Subject: Re: Protection from SQL injection
In-Reply-To: <dcc563d10804262224l431f0ae3t6c75af94a1ef3876@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox