Skip site navigation (1)
Skip section navigation (2)
Peripheral Links
Header And Logo
|
Site Navigation
Re: SQL injection in a ~ or LIKE statement
- From: Volkan YAZICI <yazicivo(at)ttnet(dot)net(dot)tr>
- To: "Uwe C. Schroeder" <uwe(at)oss4u(dot)com>
- Cc: pgsql-general(at)postgresql(dot)org, hefferon9(at)adelphia(dot)net
- Subject: Re: SQL injection in a ~ or LIKE statement
- Date: Mon, 23 Oct 2006 10:19:13 +0300
- Message-id: <20061023071534(dot)GA1363(at)alamut>
On Oct 22 02:33, Uwe C. Schroeder wrote: > On Sunday 22 October 2006 12:32, Volkan YAZICI wrote: > > If I were you, I'd ask psycopg2 developers to implement parameters that > > are natively supported by PostgreSQL. With parameters, you won't mess up > > with any escaping or injection related issue. > > psycopg2 supports parameters which are escaped properly. You're wrong. psycopg uses Python style parameters and escapes the specified input before inserting into query string. See documentation of PQexecParams() for the "parameters" I mentioned. I think, you're confusing terms. I just checked psycopg2 source code and couldn't see any parameter implementation. Regards.
- References:
- SQL injection in a ~ or LIKE statement
- From: hefferon9
- Re: SQL injection in a ~ or LIKE statement
- From: Volkan YAZICI
- Re: SQL injection in a ~ or LIKE statement
- From: Uwe C. Schroeder
- SQL injection in a ~ or LIKE statement
- Prev by Date: Re: How to determine initdb parameters on old database?
- Next by Date: Re: Overload after some minutes, please help!
- Previous by thread: Re: SQL injection in a ~ or LIKE statement
- Next by thread: Re: SQL injection in a ~ or LIKE statement
- Indexes: