Received: from localhost (unknown [200.46.204.184])
	by developer.postgresql.org (Postfix) with ESMTP id 5B9742E0031
	for <pgsql-sql-postgresql.org@developer.postgresql.org>;
	Sun, 27 Apr 2008 02:34:04 -0300 (ADT)
Received: from developer.postgresql.org ([200.46.204.71])
	by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024)
	with ESMTP id 47226-01-6
	for <pgsql-sql-postgresql.org@developer.postgresql.org>;
	Sun, 27 Apr 2008 02:33:53 -0300 (ADT)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5
Received: from wa-out-1112.google.com (wa-out-1112.google.com
 [209.85.146.179])
	by developer.postgresql.org (Postfix) with ESMTP id 4EBE22E005C
	for <pgsql-sql@postgresql.org>; Sun, 27 Apr 2008 02:31:33 -0300 (ADT)
Received: by wa-out-1112.google.com with SMTP id n7so7072376wag.5
	for <pgsql-sql@postgresql.org>; Sat, 26 Apr 2008 22:31:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	bh=UqbNetURxGoE9EKc37mfPuQzzHwFl4f9yA9M5AWYnno=;
	b=JRIsOql3Nj15c+EiiBOMlpfyU4P1OVcJeOTYKDy57CZbzsD2drwNTxcNDHKfifiQ/YCz4iHo/DUvqm29g40xyMDOBX4MYiQi9Xi1El1YcaMxxL0VxGLfxXETK4JfWqzXmIv6eemapkzJLwpUgKIz3duYjBo+nYukiqai1aKa5aM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=k1R/BLyxMdBnF36SWqkbQogcg/peH2Rp5udc9wLbcfhBSsh5ABLn8GM4JdJUcf8tFTTVyHshOia3XEVQjlijrqU1J3uRXmZD57pmTFlCn+0dg8VO7ijgZgYMD9lZyDJXrc4RGTh7ja7xJC4eWNiF0NYAwgmgJnWpJjQJzGurKi8=
Received: by 10.114.191.12 with SMTP id o12mr5048240waf.224.1209273899166;
	Sat, 26 Apr 2008 22:24:59 -0700 (PDT)
Received: by 10.114.137.7 with HTTP; Sat, 26 Apr 2008 22:24:59 -0700 (PDT)
Message-ID: <dcc563d10804262224l431f0ae3t6c75af94a1ef3876@mail.gmail.com>
Date: Sat, 26 Apr 2008 23:24:59 -0600
From: "Scott Marlowe" <scott.marlowe@gmail.com>
To: "Tom Lane" <tgl@sss.pgh.pa.us>
Subject: Re: Protection from SQL injection
Cc: "Thomas Kellerer" <spam_eater@gmx.net>, pgsql-sql@postgresql.org
In-Reply-To: <13885.1209268720@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<13885.1209268720@sss.pgh.pa.us>
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Archive-Number: 200804/191
X-Sequence-Number: 30730

On Sat, Apr 26, 2008 at 9:58 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:

>  IIRC there was some discussion recently of providing a mode in which
>  the server would reject PQexec strings containing more than one query.
>  I didn't care for it much at the time, but I think it would provide
>  most of the benefit of these suggestions with far less compatibility
>  or performance hit.

agreed.

And I trust (SQL) code review more than tying the hands of the programmers.

But I've always had the luxury of working with developers who liked me
as a DBA and were willing to do things my way, as far as the DB was
concerned anyway...