Re: Protection from SQL injection

Поиск
Список
Период
Сортировка
От Andrew Sullivan
Тема Re: Protection from SQL injection
Дата
Msg-id 20080502204712.GL21477@commandprompt.com
обсуждение исходный текст
Ответ на Re: Protection from SQL injection  (Chris Browne <cbbrowne@acm.org>)
Ответы Re: Protection from SQL injection  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-hackers
On Fri, May 02, 2008 at 03:58:01PM -0400, Chris Browne wrote:

> Andrew Sullivan recently had some choice words about the merits of
> ENUM; I think the same applies to drivers that do
> PQexec("COMMIT;BEGIN")...

Oh, heaven.  I can at least think of ways to use ENUM such that you
can justify the trade-off.  I can think of no excuse whatever for
PQexec("COMMIT; BEGIN").  That's just lazy and sloppy.  

Note also that more recent releases, concurrent with the improvements
to the drivers, also reduce the impact of this sort of database misuse
slightly.

But really, people who are doing that sort of thing have no excuse for
themselves.  They should be relegated to the same circle of hell as
people who think it's a good plan to write a crappy schema the first
time, because you can always optimise later.

A  

-- 
Andrew Sullivan
ajs@commandprompt.com
+1 503 667 4564 x104
http://www.commandprompt.com/


В списке pgsql-hackers по дате отправления:

Предыдущее
От: "Hell, Robert"
Дата:
Сообщение: Re: [PATCHES] GUC parameter cursors_tuple_fraction
Следующее
От: Simon Riggs
Дата:
Сообщение: Re: [PATCHES] GUC parameter cursors_tuple_fraction