> How can we avoid this security risk using PHP & postgreSQL?. Every system has its security caveats. But that doesn't mean it can't be taken care of. Check this link for some important security issues regarding PHP and SQL. http://forums.devshed.com/t20525/s7cec8677087e43c40ce670ad005d327c.html http://es2.php.net/manual/en/security.database.php What I do is verify all user input ($_GET and $_POST array) and not allow certain characters, most importantly ";". If they can't put a ";" they can't close a query and they can't do SQL injection. That is if you want to build the security wall at the application level. For extra security or for security at DB level you could connect as a previously created user with only read-access permission. Although at some point you might need to insert/delete stuff, you can use the read-only user while you don't need to write. A lot of times you have some public pages that everybody can access that don't need write permission. Then you can have other password-protected pages intended only for admins or people you trust that need write/delete so the security risk would be lower. Hope that helps. Adrian Tineo
