Re: Protection from SQL injection

Поиск
Список
Период
Сортировка
От PFC
Тема Re: Protection from SQL injection
Дата
Msg-id op.uae694f6cigqcu@apollo13.peufeu.com
обсуждение исходный текст
Ответ на Re: Protection from SQL injection  (Hannu Krosing <hannu@krosing.net>)
Список pgsql-hackers
> Could we also get a mode, where PREPARE would only be allowed for
> queries of the form "SELECT * FROM func(?,?,?,?,?); :)
Actually, that is similar to the concept of "global prepared statements"  
that I proposed some time ago, but I will not have time to write the  
patch, alas...Idea was that the DBA can create a list of SQL statements (with  
privileges about who can execute them, just like functions) which are  
prepared on-demand at the first EXECUTE by the client.This would enhance performance (but for performance I like the
ideaof  
 
caching plans better).It would be pretty cumbersome, though, to execute dynamic SQL like the  
typical search query...


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tino Wildenhain
Дата:
Сообщение: Re: Protection from SQL injection
Следующее
От: "Thomas Mueller"
Дата:
Сообщение: Re: Protection from SQL injection