Re: Protection from SQL injection

Поиск
Список
Период
Сортировка
От Thomas Mueller
Тема Re: Protection from SQL injection
Дата
Msg-id 5f211bd50804300822v1c47c664l42e97f8fa4a4c69e@mail.gmail.com
обсуждение исходный текст
Ответ на Re: Protection from SQL injection  (Tino Wildenhain <tino@wildenhain.de>)
Ответы Re: Protection from SQL injection  ("Gurjeet Singh" <singh.gurjeet@gmail.com>)
Список pgsql-hackers
Hi,

Constants are just convenience: instead of constants, user defined
functions can be used. This already works, however it's a bit verbose:

CREATE FUNCTION STATE_ACTIVE() RETURNS VARCHAR AS
$$ BEGIN RETURN 'active'; END; $$ LANGUAGE PLPGSQL;

Usage is almost the same:
SELECT * FROM USERS WHERE STATE=STATE_ACTIVE();

>  therefore arbitrary macro expansion like in those "plenty of languages"
>  does not seem like a good idea to me.

This is _not_ macro expansion as in C '#define'. Constants are typed,
as in C++ 'const' and Java 'static final'. The question is only:
should the user explicitly state the data type, or should the data
type be deduced from the value. Both is possible:

CREATE CONSTANT STATE_ACTIVE VALUE 'active';
CREATE CONSTANT STATE_ACTIVE TEXT VALUE 'active';

Regards,
Thomas


В списке pgsql-hackers по дате отправления:

Предыдущее
От: PFC
Дата:
Сообщение: Re: Protection from SQL injection
Следующее
От: Bryce Nesbitt
Дата:
Сообщение: Re: Proposed patch - psql wraps at window width