Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?

Поиск
Список
Период
Сортировка
От David Wilson
Тема Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?
Дата
Msg-id e7f9235d0811041131q58a152c8yc9e666b593ea2ce1@mail.gmail.com
обсуждение исходный текст
Ответ на Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?  ("Webb Sprague" <webb.sprague@gmail.com>)
Список pgsql-general
On Tue, Nov 4, 2008 at 2:12 PM, Webb Sprague <webb.sprague@gmail.com> wrote:

> Can't do that.  (Or I wouldn't have asked the question.)  Need a WWW
> interface, period.

A WWW interface doesn't preclude the suggestion of simply relying on
permissions to maintain safety and providing what amounts to a query
command line; I've got that exact thing in php for one of my DBs. The
user can't make db changes, and just from paranoia I check the query
for certain bad keywords (delete, insert, into, update, drop, create,
alter, etc) before passing it on. On return, some simple php functions
create a table with the appropriate column names and such.

It's surely the simplest solution, and it definitely will work.

--
- David T. Wilson
david.t.wilson@gmail.com

В списке pgsql-general по дате отправления:

Предыдущее
От: "Webb Sprague"
Дата:
Сообщение: Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?
Следующее
От: Sam Mason
Дата:
Сообщение: Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?