Re: Protection from SQL injection

Поиск
Список
Период
Сортировка
От Alvaro Herrera
Тема Re: Protection from SQL injection
Дата
Msg-id 20080502145358.GC2320@alvh.no-ip.org
обсуждение исходный текст
Ответ на Re: Protection from SQL injection  (Darren Reed <darrenr+postgres@fastmail.net>)
Ответы Re: Protection from SQL injection  ("Greg Sabino Mullane" <greg@turnstep.com>)
Список pgsql-hackers
Darren Reed wrote:

> Because interacting with the database is always through an action
> that you do and if you're being half way intelligent about it, you
> are always checking that each action succeeded before going on to
> the next.

Hmm, it won't be pretty for the drivers that do PQexec("COMMIT; BEGIN").
The driver will think that it's in a transaction when in fact the second
command in the string has been ignored, and so it's not ...

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: Protection from SQL injection
Следующее
От: Michael Meskes
Дата:
Сообщение: Re: ecpg issue - not sending datatype to the backend