libpq: What can and cannot be bound? How to know?

From: Dominique Devienne <ddevienne(at)gmail(dot)com>
To: pgsql-general(at)lists(dot)postgresql(dot)org
Subject: libpq: What can and cannot be bound? How to know?
Date: 2023-06-21 09:00:38
Message-ID: CAFCRh-8kT2+h7sEy_vSaeogL_rFZHsxCt7Gg7BAXq7gYnSBM0g@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

For example with [NOTIFY][1]. The doc states:

> Payload: This must be specified as a simple string literal

Does that mean we cannot bind the payload?
I.e. the pseudo code:
```
conn.exec(bind(msg), "NOTIFY {} $1", conn.escapeName(channel));
```
is invalid? And I must use instead
```
conn.exec("NOTIFY {} {}", conn.escapeName(channel),
conn.escapeLiteral(msg))`?
```
I can try, of course, but could there be a obvious way to know what can and
cannot be bound, just from the doc?

That would make it easier to deal with SQL injection to be able to bind for
example.
And knowing what can be bound would be useful.

My $0.02. Thanks, --DD

[1]: https://www.postgresql.org/docs/current/sql-notify.html

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Tomas Vondra 2023-06-21 10:43:33 Re: pb with join plan
Previous Message Laurenz Albe 2023-06-21 08:40:50 Re: strange behavior of .pgpass file