libpq: What can and cannot be bound? How to know?

Поиск
Список
Период
Сортировка
От Dominique Devienne
Тема libpq: What can and cannot be bound? How to know?
Дата
Msg-id CAFCRh-8kT2+h7sEy_vSaeogL_rFZHsxCt7Gg7BAXq7gYnSBM0g@mail.gmail.com
обсуждение исходный текст
Ответы Re: libpq: What can and cannot be bound? How to know?
Список pgsql-general
For example with [NOTIFY][1]. The doc states:

> Payload: This must be specified as a simple string literal

Does that mean we cannot bind the payload?
I.e. the pseudo code:
```
conn.exec(bind(msg), "NOTIFY {} $1", conn.escapeName(channel));
```
 is invalid? And I must use instead
```
conn.exec("NOTIFY {} {}", conn.escapeName(channel), conn.escapeLiteral(msg))`?
```
I can try, of course, but could there be a obvious way to know what can and cannot be bound, just from the doc?

That would make it easier to deal with SQL injection to be able to bind for example.
And knowing what can be bound would be useful.

В списке pgsql-general по дате отправления:

Предыдущее
От: Laurenz Albe
Дата:
Сообщение: Re: strange behavior of .pgpass file
Следующее
От: Tomas Vondra
Дата:
Сообщение: Re: pb with join plan