Re: binds only for s,u,i,d?

On Wed, 2006-07-05 at 06:55 -0400, Agent M wrote:
> Like you said, it would make sense to have binds anywhere where there 
> are quoted strings- if only for anti-injection. There could be a "flat" 
> plan which simply did the string substitution with the proper escaping 
> at execute time.

I don't see the point of implementing this in the backend. Perhaps what
you're really asking for is basically PQescapeIdentifier()?

> Escaping vulnerabilities would then be taken care of by server updates.

Escaping vulnerabilities are hardly the common case; in any case,
implementing this in libpq would allow a similar upgrade path.

-Neil