Re: Effectiveness of pg_escape_string at blocking SQL injection attacks

On Fri, May 27, 2005 at 10:57:16 -0500,
  Ed Finkler <coj@cerias.purdue.edu> wrote:
> Folks,
>
> The php mysql api has a function "mysql_real_escape_string" that seems
> to be able to thwart known SQL injection attacks -- at least the ones of
> which I and other people I've discussed this with know.  I am curious to
> know if pg_escape_string is as effective.  If not, what would need to be
> modified to make it more effective?
>
> (there is a possibility that I may be able to get a grad student to work
>  on this at the center, so detailed responses would be appreciated.)

The best advice is to use bind parameters rather than trying to build
SQL strings consisting partly of user input.