Talk About Network

Google


Register and Login
Nick
Password
Register create new account Sign up is FREE and you can post replies, new topics, bookmark posts and more!
Recover lost password


Data Bases > Pgsql Hackers > Re: Protection ...
Latest [ Topics | Posts ] Archive Post A New Topic Post a Reply
<< Topic < Post Post 9 of 11 Topic 9296 of 10114
Post > Topic >>

Re: Protection from SQL injection

by Chris Browne <cbbrowne@[EMAIL PROTECTED] > May 2, 2008 at 03:58 PM

alvherre@[EMAIL PROTECTED]
 (Alvaro Herrera) writes:
> Darren Reed wrote:
>
>> Because interacting with the database is always through an action
>> that you do and if you're being half way intelligent about it, you
>> are always checking that each action succeeded before going on to
>> the next.
>
> Hmm, it won't be pretty for the drivers that do PQexec("COMMIT; BEGIN").
> The driver will think that it's in a transaction when in fact the second
> command in the string has been ignored, and so it's not ...

We have worked pretty hard around here to expunge use of drivers that
do this sort of thing.  (Cough, cough, "dbrow"...)

Recent versions of PostgreSQL don't suffer too badly, but back in the
7.2/7.4 days, we had applications that left transactions open "<IDLE>
in transaction" for days at a time (if a user quit using the web app
without expressly logging out), with _atrocious_ results.

Andrew Sullivan recently had some choice words about the merits of
ENUM; I think the same applies to drivers that do
PQexec("COMMIT;BEGIN")...
-- 
output = ("cbbrowne" "@[EMAIL PROTECTED]
" "linuxfinances.info")
http://www3.sympatico.ca/cbbrowne/advocacy.html
:FATAL ERROR -- ILLEGAL ERROR
 




 11 Posts in Topic:
Re: Protection from SQL injection
darrenr+postgres@[EMAIL P  2008-05-02 22:08:07 
Re: Protection from SQL injection
tgl@[EMAIL PROTECTED] (T  2008-05-02 10:52:36 
Re: Protection from SQL injection
darrenr@[EMAIL PROTECTED]  2008-05-04 22:40:06 
Re: Protection from SQL injection
tgl@[EMAIL PROTECTED] (T  2008-05-05 10:13:37 
Re: Protection from SQL injection
darrenr@[EMAIL PROTECTED]  2008-05-06 00:00:27 
Re: Protection from SQL injection
greg@[EMAIL PROTECTED] (  2008-05-05 20:00:43 
Re: Protection from SQL injection
alvherre@[EMAIL PROTECTED  2008-05-02 10:53:58 
Re: Protection from SQL injection
greg@[EMAIL PROTECTED] (  2008-05-02 17:26:14 
Re: Protection from SQL injection
Chris Browne <cbbrowne  2008-05-02 15:58:01 
Re: Protection from SQL injection
ajs@[EMAIL PROTECTED] (A  2008-05-02 16:47:12 
Re: Protection from SQL injection
tgl@[EMAIL PROTECTED] (T  2008-05-02 17:43:26 

Post A Reply:
  Go here to Signup

AddThis Feed Button


About - Advertising - Contact - Frequently Asked Questions - Privacy Policy - Terms of Use - Signup

Contact
tan12V112 Sun Sep 7 1:33:57 CDT 2008.