Re: Protection from SQL injection

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: Protection from SQL injection
Дата
Msg-id 20390.1209576499@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: Protection from SQL injection  ("Gurjeet Singh" <singh.gurjeet@gmail.com>)
Ответы Re: Protection from SQL injection  ("Gurjeet Singh" <singh.gurjeet@gmail.com>)
Список pgsql-hackers
"Gurjeet Singh" <singh.gurjeet@gmail.com> writes:
> Maybe we can extend the SQL's WITH clause do declare the constant along with
> the query, and not separate from the query.

> WITH CONSTANT c_jobrole = 'clerk', CONSTANT c_dept = 10
> SELECT * FROM emp WHERE jobrole = c_jobrole and deptno = c_dept;

[ scratches head... ]  And that will provide SQL injection protection how?

Anyway, you hardly need new syntax to do that, I'd expect
WITH SELECT 'clerk' AS c_jobrole ...

to accomplish it just fine.
        regards, tom lane


В списке pgsql-hackers по дате отправления:

Предыдущее
От: "Gurjeet Singh"
Дата:
Сообщение: Re: Protection from SQL injection
Следующее
От: "Gurjeet Singh"
Дата:
Сообщение: Re: Protection from SQL injection