Re: Protection from SQL injection

> Could we also get a mode, where PREPARE would only be allowed for
> queries of the form "SELECT * FROM func(?,?,?,?,?); :)
Actually, that is similar to the concept of "global prepared statements"  
that I proposed some time ago, but I will not have time to write the  
patch, alas...Idea was that the DBA can create a list of SQL statements (with  
privileges about who can execute them, just like functions) which are  
prepared on-demand at the first EXECUTE by the client.This would enhance performance (but for performance I like the
ideaof  
 
caching plans better).It would be pretty cumbersome, though, to execute dynamic SQL like the  
typical search query...