Re: How does one make the following psql statement sql-injection resilient?

From: Alvaro Herrera <alvherre(at)2ndquadrant(dot)com>
To: "David G(dot) Johnston" <david(dot)g(dot)johnston(at)gmail(dot)com>
Cc: Andy Colson <andy(at)squeakycode(dot)net>, "pgsql-general(at)postgresql(dot)org" <pgsql-general(at)postgresql(dot)org>
Subject: Re: How does one make the following psql statement sql-injection resilient?
Date: 2015-03-17 03:59:31
Message-ID: 20150317035931.GJ3636@alvh.no-ip.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

David G. Johnston wrote:

> Thanks! I got the gist even with the typo. I actually pondered about
> prepare/execute after hitting send. Am I correct in remembering that
> "CREATE TEMP TABLE" cannot be prepared? I was using the actual query with
> CREATE TEMP TABLE and then issuing "\copy" to dump the result out to the
> file. The limitation of copy to having to be written on a single line
> makes the intermediary temporary table seem almost a necessity.

CREATE TEMP TABLE AS EXECUTE

--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Craig Ringer 2015-03-17 03:59:48 Re: Postgresql BDR(Bi-Directional Replication) Latency Monitoring
Previous Message Craig Ringer 2015-03-17 03:56:53 Re: pgpool + BDR, is it possible?