Search Postgresql Archives

Re: Semi-customized queries? Subset of SQL? Accessing the parser? Injection?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Nov 4, 2008 at 2:12 PM, Webb Sprague <webb.sprague@xxxxxxxxx> wrote:

> Can't do that.  (Or I wouldn't have asked the question.)  Need a WWW
> interface, period.

A WWW interface doesn't preclude the suggestion of simply relying on
permissions to maintain safety and providing what amounts to a query
command line; I've got that exact thing in php for one of my DBs. The
user can't make db changes, and just from paranoia I check the query
for certain bad keywords (delete, insert, into, update, drop, create,
alter, etc) before passing it on. On return, some simple php functions
create a table with the appropriate column names and such.

It's surely the simplest solution, and it definitely will work.

-- 
- David T. Wilson
david.t.wilson@xxxxxxxxx

-- 
Sent via pgsql-general mailing list (pgsql-general@xxxxxxxxxxxxxx)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Postgresql Jobs]     [Postgresql Admin]     [Postgresql Performance]     [Linux Clusters]     [PHP Home]     [PHP on Windows]     [Kernel Newbies]     [PHP Classes]     [PHP Books]     [PHP Databases]     [Postgresql & PHP]     [Yosemite]
  Powered by Linux