Re: PL/pgSQL EXECUTE quote_ident(), and SQL injection

From: "Knut P(dot) Lehre" <knutpl(at)broadpark(dot)no>
To: pgsql-general(at)postgresql(dot)org
Subject: Re: PL/pgSQL EXECUTE quote_ident(), and SQL injection
Date: 2009-06-26 10:39:24
Message-ID: fbb5bdf644be6.4a44c17c@broadpark.no
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Since this stripped down example function looks a bit meaningless, I'd like to rephrase the question to make it more clear: Does quote_ident() prevent all ways of trying to inject SQL into $1 so that the testinjection function cannot be used to do anything else than setting column c to null in an existing table?

----- Original Message -----
> Is there any known way to inject SQL into a function similar to this?
>
> create function testinjection(text,integer)
>  returns void as
> $BODY$
> declare
> begin
> execute 'update '||quote_ident($1)||' set c=null where id='||$2;
> return;
> end;
> $BODY$
> language 'plpgsql' volatile security definer;
> grant execute on function testinjection(text,integer) to public;
>


In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Pavel Stehule 2009-06-26 11:52:55 Re: PL/pgSQL EXECUTE quote_ident(), and SQL injection
Previous Message Nishkarsh 2009-06-26 10:17:43 Re: Trigger Function and backup