On Aug 10, 6:56 am, atec_p...@xxxxxxxx (Alejandro Torras) wrote:
> -- English --
> Hi,
>
> Is there some way to put values in a INSERT statement
> without taking care of apostrophes?
>
> In example:
> INSERT INTO persons VALUES ('Harry', 'O'Callaghan');
> ^^^^^^^^^^^
>
> I think that it can be used some kind of length-marker
> to help the parsing of the value.
>
> In example:
> INSERT INTO persons VALUES ('Harry', @11:O'Callaghan);
>
> I think this approach could help reducing the sql
> injections.
If you're worried about sql injections, I'm not sure what kind of
client library you're using to access your pgsql database, but most of
them should have placeholder capability, I think, which definitely
takes care of that. Your statement would become INSERT INTO persons
VALUES (?, ?) and then you would pass the execution function your two
values and it would escape them properly for you. At least that's how
it works with Perl and DBI.
Kev
---------------------------(end of broadcast)---------------------------
TIP 9: In versions below 8.0, the planner will ignore your desire to
choose an index scan if your joining column's datatypes do not
match
