Re: SQL injection in a ~ or LIKE statement

On Sunday 22 October 2006 12:32, Volkan YAZICI wrote:
> On Oct 20 05:07, hefferon9(at)adelphia(dot)net wrote:
> > I'm concerned about whether the usual parameter escaping mechanism is
> > enough in a LIKE or regular expression search.
> >
> > I run a recent Postgres version and use the Python connector psycopg2
> > for a web application. I understand that if I always escape as in
> >
> > dBres=dBcsr.execute('SELECT docText FROM documents WHERE
> > name=%(storyName)s',{'storyName':storyName})
> >
> > then I am doing the right thing.
>
> Please pay attention that [IIRC] psycopg2 uses its own escaping
> mechanism. Therefore, you should better ask this question on psycopg2
> ml.
>
> > I plan to add full text searching also; is the escaping mechanism
> > enough there?
>
> If I were you, I'd ask psycopg2 developers to implement parameters that
> are natively supported by PostgreSQL. With parameters, you won't mess up
> with any escaping or injection related issue.

psycopg2 supports parameters which are escaped properly.

Uwe

--
Open Source Solutions 4U, LLC 1618 Kelly St
Phone: +1 707 568 3056 Santa Rosa, CA 95401
Cell: +1 650 302 2405 United States
Fax: +1 707 568 6416