View Single Post

   
  #7 (permalink)  
Old 05-05-2008, 05:52 AM
Tom Lane
 
Posts: n/a
Default Re: Protection from SQL injection

Andrew Sullivan <ajs@commandprompt.com> writes:
> Oh, heaven. I can at least think of ways to use ENUM such that you
> can justify the trade-off. I can think of no excuse whatever for
> PQexec("COMMIT; BEGIN"). That's just lazy and sloppy.


> Note also that more recent releases, concurrent with the improvements
> to the drivers, also reduce the impact of this sort of database misuse
> slightly.


Actually, as of 8.3 I think the impact is zero, because of the lazy
XID allocation changes. It's still sloppy programming though.

regards, tom lane

--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

Reply With Quote