Re: SQL injection, php and queueing multiple statement

Developers,

It seems you are overlooking application user/system admin perspective.

I agree developers should use prepared statement, but application user or
system admins are not able to modify codes usually.

There are many PostgreSQL/MySQL applications that generating SQL statements.

MySQL's query API only allow single SQL statements at a time, while PostgreSQL
allows multiple statements. Therefore, MySQL users will likely to have less
impact from buggy codes compare to PostgreSQL users.

It would be nice to have API like PQquerySingle that allows only a single SQL
statement at a time.

--
Yasuo Ohgaki