Re: Is passing a list as a bound variable safe from SQL injection?

Поиск
Список
Период
Сортировка
От Stuart Bishop
Тема Re: Is passing a list as a bound variable safe from SQL injection?
Дата
Msg-id CADmi=6NsbvmaELJF0JFswnqPeVJuY_X1GSQ9SqQt4GS=Et5rhg@mail.gmail.com
обсуждение исходный текст
Ответ на Re: Is passing a list as a bound variable safe from SQL injection?  (Federico Di Gregorio <fog@dndg.it>)
Список psycopg
On Thu, Oct 3, 2013 at 2:53 PM, Federico Di Gregorio <fog@dndg.it> wrote:

> Btw, I am a little curious, what kind of query requires an array of
> ~11000 values? Surely there is a better way to write it, isn't it?

I see it a lot when breaking up bulk operations into small chunks. If
you can't use a temporary table persisting across transactions (eg.
pgbouncer in transaction pooling mode), the fastest way is often a
script that first sucks down a huge list of ids and does the update in
lots of small transactions. It works because PG happily handles
queries like 'UPDATE foo SET bar='baz' WHERE id IN ([... 10,000 ids
...])' without breaking a sweat, even though on the surface it looks
like a really silly thing to do.

--
Stuart Bishop <stuart@stuartbishop.net>
http://www.stuartbishop.net/


В списке psycopg по дате отправления:

Предыдущее
От: Daniele Varrazzo
Дата:
Сообщение: Re: Is passing a list as a bound variable safe from SQL injection?
Следующее
От: Peter Eisentraut
Дата:
Сообщение: Re: psycopg2 doesn't use LDFLAGS from pg_config