Re: Protection from SQL injection

[PFC <lists(at)peufeu(dot)com>]

> Could we also get a mode, where PREPARE would only be allowed for
> queries of the form "SELECT * FROM func(?,?,?,?,?); :)

	Actually, that is similar to the concept of "global prepared statements"  
that I proposed some time ago, but I will not have time to write the  
patch, alas...
	Idea was that the DBA can create a list of SQL statements (with  
privileges about who can execute them, just like functions) which are  
prepared on-demand at the first EXECUTE by the client.
	This would enhance performance (but for performance I like the idea of  
caching plans better).
	It would be pretty cumbersome, though, to execute dynamic SQL like the  
typical search query...