Re: control max length of parameter values logged

Bruce Momjian <bruce@momjian.us> writes:
> I am sorry --- I am confused.  Why are we truncating or allowing control
> of truncation of BIND parameter values, but have no such facility for
> queries.  Do we assume queries are shorter than BIND parameters, or is
> it just that it is easier to trim BIND parameters than values embedded
> in non-EXECUTE queries.

The cases that Alvaro was worried about were enormous values supplied
via bind parameters.  We haven't heard comparable complaints about
the statement text.  Also, from a security standpoint, the contents
of the statement text are way more critical than the contents of
an out-of-line parameter; you can't do SQL injection from the latter.
So I think the audience for trimming would be a lot smaller for
statement-text trimming.

            regards, tom lane