Received: from localhost (unknown [200.46.204.183]) by developer.postgresql.org (Postfix) with ESMTP id DCCD52E003E for ; Sat, 26 Apr 2008 18:33:10 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 30029-08 for ; Sat, 26 Apr 2008 18:33:07 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from ciao.gmane.org (main.gmane.org [80.91.229.2]) by developer.postgresql.org (Postfix) with ESMTP id C6E412E0032 for ; Sat, 26 Apr 2008 18:33:07 -0300 (ADT) Received: from list by ciao.gmane.org with local (Exim 4.43) id 1Jps11-0004ZZ-Mk for pgsql-sql@postgresql.org; Sat, 26 Apr 2008 21:33:03 +0000 Received: from ppp-88-217-42-100.dynamic.mnet-online.de ([88.217.42.100]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 26 Apr 2008 21:33:03 +0000 Received: from spam_eater by ppp-88-217-42-100.dynamic.mnet-online.de with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 26 Apr 2008 21:33:03 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: pgsql-sql@postgresql.org From: Thomas Kellerer Subject: Re: Protection from SQL injection Date: Sat, 26 Apr 2008 23:32:58 +0200 Lines: 6 Message-ID: References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: ppp-88-217-42-100.dynamic.mnet-online.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.12) Gecko/20080213 Thunderbird/2.0.0.12 Mnenhy/0.7.5.666 In-Reply-To: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200804/186 X-Sequence-Number: 30725 Thomas Mueller wrote on 26.04.2008 18:32: > Literals can still be used when using query tools, or in applications considered 'safe'. I fail to see how the backend could distinguish between a query sent by a query tool and a query sent by an "application". Thomas