Re: Sql injection attacks

Поиск
Список
Период
Сортировка
От Magnus Hagander
Тема Re: Sql injection attacks
Дата
Msg-id 6BCB9D8A16AC4241919521715F4D8BCE4569AD@algol.sollentuna.se
обсуждение исходный текст
Ответ на Sql injection attacks  (Geoff Caplan <geoff@variosoft.com>)
Список pgsql-general
> MH> If you use the parametrised formats, e.g.
> MH> "SELECT * FROM foo WHERE bar=@bar"
> MH> or just "sp_foo" in the case of the stored procedure (the driver
> MH> will pick up parameter names automatically)
>
> Are you saying that "@bar" is part of the Postgres query
> syntax? If it is, I can't find it in the 7.4 docs. What do
> you mean by "the parameterised formats"? I would appreciate a
> clarification and the URL of the relevant documentation.

Sorry, this is the ADO syntax used in ASP - I was referring to the
incorrect claims about MSSQL you had found. It definitly applies to
MSSQL on ASP, not 100% sure about pgsql on ASP.

Another common syntax is the "?" syntax, e.g. "SELECT * FROM foo EBRE
bar=?", that's used in for example DBI.

So it depends on what interface you are using to connect to the server.
If it's straight libpq, you should look at PQexecParams() or
PQexecPrepared(), see
http://www.postgresql.org/docs/7.4/static/libpq-exec.html.

//Magnus


В списке pgsql-general по дате отправления:

Предыдущее
От: Geoff Caplan
Дата:
Сообщение: Re: Sql injection attacks
Следующее
От: "Matthew D. Fuller"
Дата:
Сообщение: Re: Sql injection attacks