Search Postgresql Archives

Re: SQL injection in a ~ or LIKE statement

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Oct 23, 2006 at 07:58:30AM +0200, Harald Armin Massa wrote:

> adding: Judging from the mails of  Frederico, developer of psycopg2, he was
> also in the "early notify circle" of the 8.13->8.14 escaping improvement.
> So, if done correctly the DB API way, all escaping with psycopg2 is fine.

On the psycopg2 list Frederico writes that, technically,
psycopg2 currently uses PQEscapeStringConn and he plans on
adding out-of-query bind parameter support at some point in
the future.

Karsten
-- 
GPG key ID E4071346 @ wwwkeys.pgp.net
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Postgresql Jobs]     [Postgresql Admin]     [Postgresql Performance]     [Linux Clusters]     [PHP Home]     [PHP on Windows]     [Kernel Newbies]     [PHP Classes]     [PHP Books]     [PHP Databases]     [Postgresql & PHP]     [Yosemite]
  Powered by Linux